Header Based Redirection

[gprime31]

when it says Header Based Redirection
what headers is it using?

[r0075h3ll]

I've already written a blog post that answers your query : https://r0075h3ll.github.io/Open-Redirects-Everything-That-You-Should-Know/

[gprime31]

Thanks.
ok so the redirect:
https://example.com//google.com shows up in the location header.
problem is Location: https://site.com/example.com <--- false positive and it won't redirect.
but gets flagged as header based redirection.

[r0075h3ll]

So the thing is that if the Location header exists in the response then it only shows what the website is redirecting to after sending the payload, nothing more.

[gprime31]

got it, thanks
and great tool :)

[r0075h3ll]

Thanks mate ✌️