Open Redirect
lowWhat is Open Redirect?
An open redirect vulnerability allows attackers to craft URLs using the legitimate domain that redirect users to malicious external websites.
How it works
The application uses a URL parameter (e.g., /login?redirect=https://evil.com) to redirect users after an action. An attacker crafts a link using the trusted domain that redirects to their phishing site.
Impact
Phishing attacks that appear to originate from a trusted domain, credential theft, malware distribution, and OAuth token theft.
ShieldReport identifies redirect parameters in URLs and tests with external domain payloads to verify if unvalidated redirects are possible.
How to fix it
Validate redirect URLs against an allowlist of permitted domains. Use relative paths instead of full URLs for redirects. Warn users before redirecting to external sites.
Tags
Is your site vulnerable to Open Redirect?
Run a free scan to find out in under 2 minutes.
Scan Now