ORAT - An open redirect analysis tool

Abstract

Securing web applications against open redirect vulnerabilities is important for protecting users from malicious redirection and phishing attacks. Open Redirect attacks occur when a malicious actor manipulates a link on a vulnerable web-site to redirect users to a malicious destination, often disguised as legitimate. This paper proposes a Google Chrome extension named Open Redirect Analysis Tool (ORAT), a tool that analyses a website for potential open redirect attacks. ORAT enables the detection of such vulnerabilities directly within the browser. It uses a straightforward interface and it simplifies the process of scanning web applications for unsafe redirects by applying a curated set of test payloads to uncover vulnerabilities, from the obvious to the subtle ones. The tests show that ORAT can identify and present open redirect vulnerabilities. Also, a discussion is provided about the limitations encountered, such as the scope of testing payloads and browser specificity, and a roadmap for future iterations of the proposed tool is proposed. By advancing the capabilities for early detection of redirect vulnerabilities, ORAT contributes to the set of tools available to cybersecurity practitioners and web developers, aiming to foster a secure online environment.