# Open Redirect

### Source Code snippet

* User-supplied input is being passed to a redirect function.

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2F8szemzCxPcsWodpi0sV1%2Fimage.png?alt=media&#x26;token=5392c400-0a51-4883-a298-43dee79a12ac" alt=""><figcaption></figcaption></figure>

### Goal

Forcing the application to redirect to an attacker-controlled site.

EX: redirecting to Google, if it does then the application is <mark style="color:red;">vulnerable</mark>.

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FMdhxawclGzjsgQjplEoZ%2Fimage.png?alt=media&#x26;token=221ad89f-3832-4fc1-96db-bae3f4969bce" alt=""><figcaption><p>Open Redirect</p></figcaption></figure>

### &#x20;Impact

* Considered a low-impact vulnerability.
* Can be chained with other bugs such as SSRF, OATH bypass, and other things giving you greater impact.
