During a web application penetration test, a tester discovers that the application includes user-supplied input in an HTTP redirect URL parameter without validation: https://app.com/redirect?url=https://victim.com. What vulnerability is present and what is the risk?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because an open redirect allows attackers to craft URLs on the legitimate domain (app.com) that redirect users to attacker-controlled sites; users see the trusted domain in the link and are less suspicious, making open redirects effective phishing aids. A is wrong because SQL injection requires database query interaction; URL redirect parameters do not interact with databases in the way described.
Full explanation below image
Full Explanation
B is correct because an open redirect allows attackers to craft URLs on the legitimate domain (app.com) that redirect users to attacker-controlled sites; users see the trusted domain in the link and are less suspicious, making open redirects effective phishing aids. A is wrong because SQL injection requires database query interaction; URL redirect parameters do not interact with databases in the way described. C is wrong because SSRF causes the server to make requests to internal resources; an open redirect sends the user's browser to an external URL, not the server making internal requests. D is wrong because XSS requires reflected JavaScript in the page; a redirect sends the browser elsewhere without executing scripts in the current page context.