Return URL

Provide an absolute external URL using http or https.

Return URL (substring filter active)

The filter only checks if the supplied URL contains the substring 'webgoat'.

Target URL Tracking Token

Target URL (double-encoded)

External URL to test mitigation

Try an absolute external URL (http/https) that is NOT an internal host.

Prevention Patterns

Safe Destination ID Use strict allow lists, canonical host comparison, and server-side mapping of destination ids.

Also experiment with a real (unsafe) redirect: /OpenRedirect/realRedirect?url=https://example.com