scanrub
Web SecurityLowUnvalidated redirect

Open Redirect

A redirect parameter accepts arbitrary destinations, aiding phishing and token theft.

Live Playground · Powered by this research
Redirect URL Analyzer

Paste a redirect URL and see if it points off-site (potentially unsafe).

Payloads from this research (10 total)
https://evil.com
//evil.com
\\evil.com
https://allowed.com@evil.com
These payloads were synthesized from real HackerOne disclosures. Click any payload to copy it, then paste it into the tester above to see how our detection classifies it.

Overview

When a redirect target comes from user input without validation, attackers craft trusted-looking links that bounce victims to malicious sites or leak OAuth tokens via the redirect.

How it works

When a redirect target comes from user input without validation, attackers craft trusted-looking links that bounce victims to malicious sites or leak OAuth tokens via the redirect.

Example

http
GET /login?next=https://evil.tld  ->  302 Location: https://evil.tld

Impact

Phishing credibility, OAuth/token leakage, and SSRF/filter-bypass chaining.

Detection

Fuzz redirect-shaped params (next, url, return, redirect_uri) with external and bypass payloads; confirm the Location header.

Prevention

  • Allowlist redirect destinations or use relative paths only.
  • Map redirect targets to server-side keys rather than raw URLs.
  • Strictly validate OAuth redirect_uri against registered values.

Real-world HackerOne reports

Sampled from 170 disclosed reports analyzed for the Open Redirect research playbook.

Weekly security research

New vulnerability playbooks, tool updates, and bug bounty insights - delivered to your inbox. No spam.

Unsubscribe anytime. We respect your inbox.
Press ⌘K to search×