Using Burp to Test for Open Redirections - Port Swigger
Summary: PortSwigger's tutorial describes open redirections as vulnerabilities where a web application redirects to a location taken from user-supplied data, which an attacker could use for phishing or credential theft. It walks through using Burp's Proxy, Spider and Repeater tools against the ZAP-WAVE test application from OWASP's Broken Web Application Project, filtering the site map for 3xx status codes and editing URL parameters to see whether the location header changes to an external domain.
Bottom line: A redirect that accepts an attacker-chosen external URL turns your own trusted domain into the delivery vehicle for a phishing link, and the test here is as simple as changing one parameter and checking the location header.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026