Find unvalidated destination redirects and server-side request forgery endpoints querying internal networks.
Tests query parameters (?returnUrl=, ?dest=, ?url=) with external protocol schemes, cloud metadata addresses (169.254.169.254), and localhost loopbacks.
Canonical test payload dispatched during security surface audits.
/login?redirect=https://phishing-site.com/authWatch the probe engine test this signature in an isolated sandbox.
Relative URL Validation
res.redirect(req.query.redirectUrl);
const url = req.query.redirectUrl;
if (url.startsWith('/') && !url.startsWith('//')) {
res.redirect(url);
} else { res.redirect('/dashboard'); }Ensure redirection destinations are strictly validated as internal relative paths or checked against trusted domain whitelists.
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for Open Redirect & SSRF Probe.
Checks commonly evaluated alongside Open Redirect & SSRF Probe during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.