⚠ FOR SECURITY TESTING PURPOSES ONLY — DO NOT DEPLOY IN PRODUCTION

Open Redirect

Unvalidated Open Redirect

[MEDIUM]

The redirect endpoint follows any user-supplied URL with no allowlist, no validation, and no warning. Useful for phishing, OAuth token theft, and SSRF chaining.

> Show hints

[1] GET /api/vuln/redirect?url=https://evil.com — follows immediately
[2] Chain with OAuth: redirect_uri=/api/vuln/redirect?url=https://attacker.com
[3] Try protocol-relative: //evil.com
[4] Try double-encoding: https%3A%2F%2Fevil.com

[1] Vulnerable Redirect Endpoint

GET /api/vuln/redirect?url=TARGET — no validation, follows any URL.

GET /api/vuln/redirect?url=<any URL>
→ HTTP 302 Location: <any URL>

Open Redirect

[1] Vulnerable Redirect Endpoint

Preset payloads:

Custom URL: