← back to room
Open Redirect
Unvalidated Redirect
Scenario
LinkBridge sends users to a URL taken from the redirect query parameter after login. There is no allowlist—any absolute URL is followed. Demonstrate a redirect to an external domain you control.
Your approach
- Open the unvalidated redirect lab and inspect the login link.
- Note the redirect parameter in the query string.
- Set it to an external HTTPS URL such as a dummy attacker site.
- Follow the redirect and confirm the lab marks success.
- Submit the task flag shown after the external redirect.
The redirect parameter is followed with no validation. Try ?redirect=https://evil.example.