I am searching about the open redirection attack. When I look at websites that try to explain the situation, they generally say to test the URLs in the form of www.example.com?redirection=... to see whether they go to the webpages written in redirection=....

Yes, they are right. We try to see whether the URL goes to the link after the injection parameters like ?redirect={payload}, ?url={payload}, ?return_to={payload}, ?jump={payload}, etc.

However, assume that our URL does not contain any injection parameters to redirect the original website. Can we perform this attack anyway?

When I look at Burp Suite's page, they say to find the URLs in website containing injection parameters and try the attack. But what if there are no such parameters? Can we also perform redirection attack by adding those injection parameters to the original URL?

Briefly, can we add the parameters like ?redirect={payload}, ?url={payload} to www.example.com to test for redirection even if the websites never contain any redirection parameters?

  • 1
    You can add any parameters you want to the URL to see if it works. This does not mean that it will work, but with luck it will. There is not magic way to turn arbitrary URLs into successful open redirection - it needs to be a vulnerable web application for this which then actually issues the redirect. Commented May 24 at 19:34
  • Under which situations is it possible? If the server is configured to do it ...
    – schroeder
    Commented May 24 at 21:21

1 Answer 1


An application has an Open Redirect vulnerability if – and only if – it takes user-controlled data to construct the URL of an (external) redirect.

This has nothing to do with any particular URL parameters. It's not even a URL-related vulnerability. The user-controlled input might as well be within the request body or a cookie or some other HTTP header. However, there must be some input which controls the redirect in the application. You cannot invent your own URL parameters. If the application doesn't process them, then nothing happens.

Of course you can try all kinds of different inputs, but again, it's up to the application which parameters it processes in which way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .