URL redirection is forwarding a user from one page to another page. There are basically two types of redirection:-
There are many servers that are vulnerable to external redirection where an application incorporates user-controllable data into the target of a redirection in an insecure way. An attacker can construct a URL within the application that causes a redirection to any random external domain.
The following are the examples of redirection:-
Please follow <a href="http://www.sashsite.com/">this link</a>. // Manual redirect
Server side scripting
header('HTTP/1.1 301 Moved Permanently');
header('Location: http://www.example.com/');
exit();
Javascript
window.location='http://www.example.com/'
The attacker can do the following impacts:-
This vulnerability can be fixed by:-