> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/open-redirection.md).

# Open Redirection

Open Redirection is a vulnerability that occurs when an application redirects users to a URL specified by user input without properly validating the destination.

Instead of restricting redirects to trusted locations, the application allows attackers to control where users are sent. This can be abused to redirect victims to malicious websites that imitate legitimate services, making phishing attacks more convincing.

Open Redirection is commonly found in login pages, logout pages, payment flows, and applications that use a `return`, `redirect`, `next`, or `url` parameter.

***

### Vulnerable Code

```php
<?php

$url = $_GET['url'];

header("Location: " . $url);
exit;

?>
```

***

### Code Explanation

The application retrieves the destination URL from the request:

```php
$url = $_GET['url'];
```

It then redirects the user to that location:

```php
header("Location: " . $url);
```

The problem is that the application does not validate whether the destination is trusted.

As a result, an attacker can control where users are redirected.

***

### How to Exploit

1. Identify functionality that redirects users based on a URL or destination parameter.
2. Determine whether the destination can be controlled by user input.
3. Verify whether the application validates the destination before performing the redirect.
4. If validation is missing, an attacker can supply an external URL as the redirect destination.
5. The application processes the request and redirects the user to the attacker-controlled location.
6. Because the redirect originates from a legitimate website, users may trust the link and be more likely to visit the malicious destination.
7. The attacker can use this behavior to support phishing campaigns, credential theft, or social engineering attacks.