← All Challenges
Challenge 35 of 66
Redirect Rogue
🟠 Hard
Web App
+100 XP
A login page redirects users after auth via ?redirect= parameter. Abuse it to redirect to an attacker-controlled site.
Try setting redirect= to an external URL. Some filters can be bypassed with //evil.com or @evil.com.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free