Active Probing & Surface
high Severity
Free Check
Open Redirect Vulnerability
Tests redirect parameters (?redirect=, ?return=, ?next=, ?url=) for unvalidated destination redirects.
Why It Matters
Open redirects make phishing attacks highly convincing because the link begins with your trusted brand URL before redirecting to malware.
How We Check This
We test redirect parameters with external domains (e.g. https://evil.com) and check if the server returns a 302/301 redirecting off-site.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
# Validate destination URLs against an explicit internal allowlist
Frequently Asked Questions
Why do attackers use open redirects?
Victims trust your official domain in the email link, but upon clicking, they are forwarded to an exact replica phishing page.