Open Redirect labs
Open Redirect
What is Open Redirect?
An Open Redirect happens when an application redirects users to attacker-controlled URLs without validation. It can be used for phishing, OAuth token theft and as a component in more complex attack chains.
Why practice Open Redirect?
Although many programs consider it low impact on its own, Open Redirect is a key component in attack chains: SSRF, OAuth token theft and targeted phishing. Learning to chain it with other vulns multiplies your impact and unlocks triage that would otherwise be marked informational.
What will you learn with the Open Redirect labs?
You'll learn common redirect patterns (?next=, ?return=, ?callback=), validation bypass techniques (//evil.com, ///, @, IDN homograph), abusing redirect_uri in OAuth to steal codes/tokens, and building reports that prove real impact (not just "it redirects to Google").
Types of Open Redirect we cover
- Protocol-relative
//evil.com — the browser reads it as a hostname. Passes allowlists that only check the http/https prefix.
- Backslash bypass
https://app.com\@evil.com — some parsers treat \ as /, others as literal. The discrepancy = bypass.
- OAuth redirect_uri
If the app allows wildcards in redirect_uri or doesn't validate the path, you steal the authorization code.
- @ trick
https://app.com@evil.com — the part before @ is userinfo. Bypasses validators that only split on the slash.
How do you find and exploit Open Redirect?
A practical playbook — from recon to proof of concept.
- 1
Hunt the redirect parameter
Look for the typical parameters that control where the app sends you after an action (login, logout, continue).
?next= ?return= ?returnUrl= ?redirect= ?url= ?callback= ?dest= - 2
Try a direct external destination
Drop your domain in and see whether the app redirects you off-site without validating. If it goes straight through, you've got the Open Redirect.
https://target/login?next=https://evil.com - 3
Bypass the validation
If they filter external domains, try protocol-relative URLs, the @ (userinfo) trick, backslashes and double slashes.
//evil.com · https://target.com@evil.com · https://target.com\@evil.com · /\evil.com - 4
Attack OAuth redirect_uri
In OAuth flows, tamper redirect_uri to a domain/path of yours. If validation is loose, the authorization code lands on your server.
/oauth/authorize?...&redirect_uri=https://evil.com/cb&response_type=code - 5
Raise impact by chaining
Alone it's worth little. Use it to steal OAuth tokens, leak the Referer header with secrets, or bypass an SSRF allowlist.
evil.com receives in logs: Referer: https://target/reset?token=ABC123
Learn the theory
Academy: OAuth & SSO
Loading labs...
View in full catalog →Frequently asked questions
What is an Open Redirect?
It's a vulnerability where the app redirects the user to an attacker-controlled URL because it doesn't validate the destination. It's used for convincing phishing, OAuth token theft and as a piece in chains with SSRF.
How is an Open Redirect exploited?
You tamper a redirect parameter (next, return, url) to point at an external domain. If there's validation, you bypass it with tricks like //evil.com, target.com@evil.com or backslashes, and raise the impact by stealing OAuth codes or the Referer header.
How do you find Open Redirect in bug bounty?
Identify every parameter that controls navigation after login, logout or OAuth, and test external destinations and their bypasses. The OAuth callback (redirect_uri) is the most valuable target because it lets you steal the authorization code.
How do you prevent Open Redirect?
Use an allowlist of permitted destinations, only redirect to internal relative paths, validate that the host exactly matches yours, and in OAuth require an exact match of the registered redirect_uri.
Why does an Open Redirect usually pay little on its own?
Because on its own the impact is phishing, which many programs mark as informational. The value is in chaining it: OAuth token theft, SSRF allowlist bypass or secret leakage via Referer turn a P5 into a P2/P1.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Open Redirect in real labs
Every Open Redirect lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime