What is an Open Redirect Vulnerability? And How to Find It

Open Redirect Vulnerability is one of the most common yet overlooked security flaws found in web applications. This vulnerability might seem simple, but it can be used by attackers for phishing, tricking users, and leading them to malicious websites. In this article, we’ll explain what an Open Redirect is, how it can affect web users, and how beginners can learn to find it in real-world websites.

An Open Redirect happens when a web application accepts user-controlled input (usually in the form of a URL) and redirects users to a different webpage without properly validating or filtering the input. This means that an attacker can modify the URL to send users to malicious websites instead of legitimate ones.

Imagine a link on a website that redirects users to a trusted page, like this:

However, if the website doesn’t check the url parameter properly, an attacker can change it like this: