Open Redirect Comprehensive Guide

What is Open Redirect?

Open Redirect is a web application vulnerability where an attacker tricks the application into redirecting users to a malicious or untrusted external site by manipulating URL parameters or links.

Open Redirect Impact Severity:

  • Phishing attacks and credential theft
  • Malware distribution
  • Session hijacking
  • Bypass of security controls
  • Loss of user trust
  • SEO spam and blacklisting

Red Team Techniques (Offensive)

1. Identification Techniques

Common Parameters

redirect
url
next
return
destination
r
forward
go
checkout
continue

Testing Methodology

  • Fuzz all parameters with external domains
  • Check both GET and POST requests
  • Test all authentication flows
  • Examine JavaScript redirects

2. Advanced Exploitation

OAuth/SSO Abuse

https://oauth-provider.com/auth?
  client_id=123&
  redirect_uri=https://attacker.com/callback

DOM-Based Redirects

window.location.href = new URLSearchParams(
  window.location.search
).get('redirect');

3. Bypass Techniques

Encoding Variations

// Double encoding
%252F%252Fevil.com

// UTF-8 encoding
%C2%A0evil.com

// HTML entities
//evil.com

Protocol Tricks

// Missing protocol
//evil.com/path

// JavaScript protocol
javascript:alert(1)

// Data URI
data:text/html,<script>alert(1)</script>

4. Real-World Attack Chains

Phishing Campaign

1. Victim receives: https://trusted.com/login?redirect=phish.com
2. Trusted site redirects to phishing page
3. Phishing page steals credentials

CSRF Exploitation

<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="amount" value="1000">
  <input type="hidden" name="to" value="attacker">
</form>
<script>document.forms[0].submit()</script>

5. Tools & Automation

Discovery Tools

  • Burp Suite Scanner
  • OWASP ZAP
  • Param Miner
  • Arjun

Exploitation Tools

  • Phishing frameworks
  • Redirector services
  • Custom scripts

Analysis Tools

  • Browser developer tools
  • Redirect tracing tools
  • Network analyzers

Blue Team Defenses (Defensive)

1. Secure Redirect Handling

Whitelist Implementation

// Python example
ALLOWED_DOMAINS = ['example.com', 'trusted.org']

def safe_redirect(url):
    domain = urlparse(url).netloc
    if domain not in ALLOWED_DOMAINS:
        return "/"  # Default safe location
    return url

Relative URLs Only

// Only allow paths, not full URLs
function validateRedirect(path) {
    return path.startsWith('/') ? path : '/';
}

2. Framework Protections

Django Safe Redirect

from django.utils.http import is_safe_url

redirect_to = request.GET.get('next')
if not is_safe_url(redirect_to, allowed_hosts=request.get_host()):
    redirect_to = '/'

Spring Security

@Controller
public class RedirectController {
    public String redirect(@RequestParam String url) {
        // Validate URL against whitelist
        if (!SecurityUtils.isSafe(url)) {
            return "redirect:/";
        }
        return "redirect:" + url;
    }
}

3. Security Headers

Content Security Policy

Content-Security-Policy: default-src 'self';
  form-action 'self';
  frame-ancestors 'none'

Referrer Policy

Referrer-Policy: strict-origin-when-cross-origin

4. Monitoring & Detection

Anomaly Detection

  • Unusual redirect patterns
  • Suspicious domains in logs
  • Spike in redirect usage

WAF Rules

  • Block known malicious domains
  • Detect encoding bypass attempts
  • Rate limit redirect endpoints

5. User Protection Measures

Visual Indicators

  • Clear external link warnings
  • Domain highlighting
  • Security badges

Confirmation Steps

  • Redirect confirmation pages
  • Countdown timers
  • Manual user approval

Education

  • Security awareness training
  • Phishing simulations
  • Reporting mechanisms

Additional Resources & References

Learning Resources

Security Tools

Open Redirect Mitigation Checklist

  • Implement strict whitelist-based redirect validation
  • Prefer relative URLs over absolute URLs
  • Use framework-provided safe redirect functions
  • Add security headers (CSP, Referrer-Policy)
  • Monitor for suspicious redirect patterns
  • Educate users about external link risks
  • Regularly audit all redirect functionality
  • Implement WAF rules for common bypass techniques

Legal Notice

This content is provided for educational purposes only. Never test security vulnerabilities against systems without explicit permission. Unauthorized testing may violate laws.