T/F: Open redirects are dangerous because of their impact
No, the impact usually is contained to things like phishing but it is an exploit that is hidden very easily.
Open redirects happen when
- The application does not redirect the users and does not check the user is sent to the proper resource
- The application redirects the users but does not check the user is sent to the proper resource
- The application redirects the users but does if check the user is sent to the proper resource
- At the back-end level
Some tips to secure against open redirect are
- Even though the user may only enter a part of the URL, still validate it like you would with anything. ALWAYS trust user input.
- Another excellent way of remedying Open Redirect vulnerability is by utilizing NeuraLegion Nexploit a black-box security testing solution that examines your application, APIs, or WebSockets to find vulnerabilities.
- Do not allow external user input
- Make sure you do not test ALL URLs where redirection is present. Some might be hidden deep within the application.
- Make sure you test ALL URLs where redirection is present. Some might be hidden deep within the application.