DOM-based open redirection

Platform: PortSwigger | Category: DOM-based vulnerabilities | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, DOM-based vulnerabilities

Summary

Walkthrough of the PortSwigger Web Security Academy lab DOM-based open redirection (DOM-based vulnerabilities). This lab demonstrates a dom-based vulnerabilities vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — DOM-based vulnerabilities

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Overview :

DOM-based open-redirection vulnerabilities arise when a script writes attacker-controllable data into a sink that can trigger cross-domain navigation. For example, the following code is vulnerable due to the unsafe way it handles the location.hash property:

 javascript read-only • copy allowed Copy
let url = /https?:\/\/.+/.exec(location.hash);
if (url) {
  location = url[0];
}

If an attacker is able to control the start of the string that is passed to the redirection API, then it may be possible to escalate this vulnerability into a JavaScript injection attack. An attacker could construct a URL with the javascript: pseudo-protocol to execute arbitrary code when the URL is processed by the browser.

An attacker may be able to use this vulnerability to construct a URL that, if visited by another user, will cause a redirection to an arbitrary external domain.

Which sinks can lead to DOM-based open-redirection vulnerabilities?

The following are some of the main sinks can lead to DOM-based open-redirection vulnerabilities:

 javascript read-only • copy allowed Copy
location
location.host
location.hostname
location.href
location.pathname
location.search
location.protocol
location.assign()
location.replace()
open()
element.srcdoc
XMLHttpRequest.open()
XMLHttpRequest.send()
jQuery.ajax()
$.ajax()

Reference - https://portswigger.net/web-security/dom-based/open-redirection

Solution :

If we click on any post, we can see at the bottom of the page there is a link to home page of the blog - <- Back to blog.

Clicking on it redirects us to the home page.

In HTTP history , we can see this request being made.

Find the DOM based open-redirect -

Clicking on View-Source , we can see there is this line of code which redirects us to home apge.

 html read-only • copy allowed Copy
<div class="is-linkback">
     <a href='#' onclick='returnUrl = /url=(https?:\/\/.+)/.exec(location); location.href = returnUrl ? returnUrl[1] : "/"'>Back to Blog</a>
</div>

From this we can understand that there is a ?url= parameter takes the url location & redirects us to / whcih is the home page.

Exploit -

So inorder to exploit this, add exploit server's address in the url with &url= parameter.

https://websecurity-academy.net/post?postId=8&url=https://exploit-0a37003a036d46cd81eece8d01c4009b.exploit-server.net/

Click enter & the lab is solved.

Key Takeaways / Lessons

• Understanding DOM-based vulnerabilities detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: DOM-based open redirection