Open Redirect
An open redirect is an application directly using a user-controllable URL for redirection, exploitable for phishing.
Purpose
To understand the phishing risk of controllable redirect URLs and their defenses; a common vulnerability in OAuth callbacks.
Mechanism
The program redirects to a user-specified URL via redirect(user_url); attackers craft https://app.com/redirect?url=https://evil.com for phishing. Defenses: redirect whitelists, relative paths, user confirmation.
Use cases
- Phishing attack defense
- OAuth callback security
- Redirect validation
Related tools
URL Parser
Parse a URL into its components: protocol, host, path, query, hash, port, username, and password. Free, private, and 100% client-side. TOOL
HTTP Status Codes
Reference table of common HTTP status codes (1xx-5xx) with names, categories, and descriptions. Free, private, and 100% client-side. TOOL