open redirect
Redirect to attacker domains by exploiting incomplete validation of the redirect parameter.
Quick answer
What is open redirect?
Redirect to attacker domains by exploiting incomplete validation of the redirect parameter.
Articles
3
Beginner
0
Intermediate
2
Advanced
1
Intermediate level
2OAuth attacks — state CSRF, redirect_uri bypass, token reuse, token IDOR
Vulnerabilities in OAuth 2.0 flows: missing state parameter, redirect_uri loose validation, cross-app token reuse, IDOR in token refresh endpoints.
Open Redirect via Backslash Bypass in the OAuth Login's redirect_url
The client-side validator checks //, : and /. The backslash slips through. Browsers normalize it to a slash and the victim ends up on evil.tld with an active session cookie.
Advanced level
1Practice open redirect with real labs
Apply the techniques in safe environments based on real bug bounty reports.
hunters training
labs from real hacks
completions
paid out for these bugs
The checklist I run on every new target
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
Stop reading about bugs and start hunting them
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime