Collected research

Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection

Soheil Khodayari, Kai Glauber and Giancarlo Pellegrino · NDSS Symposium

Re-assessment of open redirects, focused on client-side JavaScript redirections. A static and dynamic pipeline mined 184 vulnerability indicators and found 20,800 open redirects across 623 of the top 10,000 sites plus 326 more, and shows over 11.5 percent can be escalated to XSS, CSRF or information leakage.

Record

Researcher

Soheil Khodayari, Kai Glauber and Giancarlo Pellegrino

Published by

NDSS Symposium

Topic

Other

In the archive

• Collected in the 2025 research round

Related sources

• NDSS 2025 - Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection
• NDSS 2025 - Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection

Tags

• open-redirect
• xss
• csrf
• info-leak
• javascript
• static-analysis
• dynamic-analysis
• large-scale-scan
• measurement-study
• tooling
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Soheil Khodayari, Kai Glauber and Giancarlo Pellegrino, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.