Post cover image

September 7, 2026

Uncovering an Open Redirect Using Wayback

By MaMad

1 min read

Introduction

While performing reconnaissance on a web application, I used the Wayback Machine to discover previously indexed URLs and identify interesting parameters.

I used the following Wayback CDX query:

https://web.archive.org/cdx/search/cdx?url=*.redacted.com/*&fl=original&collapse=urlkey

The purpose of this query was simply to collect historical URLs and their parameters for further investigation.

Among the discovered URLs, I found an endpoint containing a returnUrl parameter:

https://www.redacted.com/Home/RetreiveLocalHostRegion?returnUrl=

The name returnUrl immediately caught my attention because parameters responsible for returning or redirecting users can sometimes be improperly validated.

I replaced its value with an external URL:

https://www.redacted.com/Home/RetreiveLocalHostRegion?returnUrl=//google.com

BOOM 💥

None

The application redirected me to:

https://google.com

without requiring any additional interaction or validation.

Steps To Reproduce

  1. Open the following URL: https://www.redacted.com/Home/RetreiveLocalHostRegion?returnUrl=//google.com
  2. The application redirects the user based on the returnUrl parameter.
  3. The browser is redirected to [https://google.com](https://google.com.).

Impact

This vulnerability allows an attacker to create a link that appears to originate from a trusted domain while redirecting the victim to an arbitrary external website.

For example:

https://www.redacted.com/Home/RetreiveLocalHostRegion?returnUrl=//attacker.com

This could be abused in phishing and social-engineering attacks, as the initial URL belongs to the trusted domain.

The impact could be greater if the vulnerable endpoint is used within sensitive authentication or redirect flows.

Conclusion

Using the Wayback Machine, I discovered a historical URL containing the returnUrl parameter. Testing the parameter with an external URL confirmed that it was not properly validated and could be used to redirect users to arbitrary external websites.

Simple parameter, simple test, open redirect. 💥