> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications/open-redirection.md).

# Open Redirection

> Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain.

### Exploitation

When reporting an open redirection vulnerability it's important to demonstrate the maximum impact. Redirecting to an arbitrary site is a great proof of concept, however, often times we can trigger a cross-site scripting vulnerability. Rather than configuring a site with a payload, we can just redirect directly to base64 encoded data data, namely a URI with a base64 encoded input containing malicious HTML/JavaScript:

```
data:text/html;base64,PHNjcmlwdD5hbGVydCgnRXhhbXBsZScpPC9zY3JpcHQ+
```

### References

{% embed url="<https://portswigger.net/kb/issues/00500100_open-redirection-reflected>" %}

{% embed url="<https://0x80dotblog.wordpress.com/2022/01/15/hacking-banks-for-fun-and-no-profit-identifying-targets-for-spear-phishing/>" %}