Apprentice
← all rooms
Open Redirect Medium

Open Redirect

Abuse redirect parameters to send victims to attacker-controlled sites.

Mission briefing

LinkBridge powers post-login redirects for several partner portals. After authentication, users are sent wherever the return URL parameter points. Security wants proof that an attacker could steer victims to a look-alike login page.

0 / 2 tasks 0 / 20 pts

Objectives

  • Redirect to an arbitrary external URL
  • Bypass a naive host prefix allowlist
Task 1 Unvalidated Redirect Low 10 pts

Scenario

LinkBridge sends users to a URL taken from the redirect query parameter after login. There is no allowlist—any absolute URL is followed. Demonstrate a redirect to an external domain you control.

Your approach

  1. Open the unvalidated redirect lab and inspect the login link.
  2. Note the redirect parameter in the query string.
  3. Set it to an external HTTPS URL such as a dummy attacker site.
  4. Follow the redirect and confirm the lab marks success.
  5. Submit the task flag shown after the external redirect.

The redirect parameter is followed with no validation.

Open lab →
Hint

?redirect=https://evil.example

Task 2 Prefix Bypass Medium 10 pts

Scenario

LinkBridge tightened policy: redirect targets must start with the trusted corporate host. The check is a simple prefix test on the full URL string. Still reach an external site without breaking the prefix rule literally.

Your approach

  1. Read the error when you point redirect at a plain external URL.
  2. Review how the prefix validator parses the scheme and host.
  3. Try URL forms where the trusted host appears early but another host receives the visit.
  4. Confirm the browser lands off-site and the lab accepts the bypass.
  5. Submit the flag from the success message.

Only URLs starting with a trusted host are allowed.

Open lab →
Hint

https://www.hackerz-labs.test@evil.example