Description

This detector identifies open redirect vulnerabilities in URL query parameters. Open redirects occur when an application accepts user-controlled input to determine redirect destinations without proper validation, allowing attackers to redirect users to malicious external sites for phishing or other attacks.

Detection Strategy

• Scans URLs that contain query parameters with names commonly used for redirects (like 'redirect', 'url', 'return', etc.)

• Replaces each redirect parameter value with a test URL pointing to a controlled domain, one parameter at a time, leaving the others untouched

• Makes HTTP requests to the modified URLs without following redirects and examines the raw 3xx response

• Reports a vulnerability when the server returns a 3xx redirect status code with a Location header pointing to the test domain

• Skipped entirely when the initial GET response is 4xx/5xx

• Reports a separate vulnerability for each vulnerable parameter, naming the parameter