Open Redirect Scanner

Open redirects allow attackers to craft URLs on your domain that redirect users to malicious sites. These are commonly exploited in phishing attacks because the initial URL appears trustworthy. Our scanner tests redirect parameters and login flows for unvalidated redirect destinations.

What This Scanner Does

Tests URL parameters commonly used for redirects (redirect, return_to, next, url, etc.) with external URLs. Checks login/logout flows for open redirect vulnerabilities and tests for redirect bypass techniques.

Why It Matters

Open redirects let attackers use your trusted domain for phishing. A URL like yoursite.com/login?redirect=evil.com looks legitimate but sends users to an attacker-controlled page. This is especially dangerous after login flows where users expect to land on your site.

Common Findings

• Unvalidated redirect parameter after login
• Open redirect in OAuth callback URL
• URL parameter allowing external domain redirect
• Redirect bypass through URL encoding

OWASP Top 10 Coverage

Related Security Checks