wstg-clnt-04

name	wstg-clnt-04
description	Testing for Client-Side URL Redirect
category	client-side
owasp_id	WSTG-CLNT-04
version	1.0.0
author	cyberstrike-official
tags	["client-side","javascript","dom","cors","wstg","clnt"]
tech_stack	[]
cwe_ids	["CWE-601"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-clnt-04

Test ID

WSTG-CLNT-04

Test Name

Testing for Client-Side URL Redirect

High-Level Description

Client-side URL redirect vulnerabilities (open redirects) occur when JavaScript redirects users based on URL parameters without validation. Attackers can craft links that redirect victims to malicious sites, facilitating phishing attacks.

---

What to Check

• location.href assignments
• location.replace() calls
• window.open() with user input
• meta refresh with parameters
• Form action manipulation

---

How to Test

Step 1: Identify Redirect Parameters

#!/bin/bash
TARGET="https://target.com"

# Common redirect parameters
params=("url" "redirect" "next" "return" "returnUrl" "goto" "destination" "redir" "redirect_uri" "continue")

for param in "${params[@]}"; do
    response=$(curl -sI "$TARGET/login?$param=https://evil.com" | grep -i "location")
    if echo "$response" | grep -qi "evil.com"; then
        echo "[VULN] Open redirect via: $param"
    fi