Open Redirect Playground
A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.
A login page that sends you wherever returnUrl says. On its own it is rated low severity — until you notice it turns a genuinely trusted domain into the first hop of a phishing link that passes every eyeball check.
How to use it
- Log in normally and watch the redirect.
- Change returnUrl to an external destination.
- See how the resulting link looks to a target.
What to take away
The value is the trusted domain
The link starts with a domain the victim knows. That is what defeats "check the link before clicking" advice.
It escalates OAuth bugs
A redirect chained into an OAuth flow can leak authorisation codes and tokens, turning a low-severity finding into account takeover.
Frequently asked questions
Why do triagers often rate open redirect as low?
In isolation it only moves a browser. It gets upgraded quickly when chained — into OAuth code theft, token leakage or a credible phishing campaign.
How is it fixed?
Allowlist permitted destinations, or accept only relative paths. Validating that the URL "contains" your domain fails against evil.com/?x=yoursite.com.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- OAuth Redirect URI Hijack Lab — An authorization server validates redirect_uri loosely. Steal an authorization code by redirecting it to your own endpoint.
- Phishing Spotter — Real email or phish? Call each one, then see the exact red flags you spotted (or missed). Trains the instinct that stops most attacks.
- CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
- Clickjacking Simulator — An invisible iframe sits on top of a fake game button. See exactly how a real click lands on a hidden "delete account" button instead.