Orion Open Redirect Hunter

Orion Open Redirect Hunter automates manual tests for Open Redirect (Unvalidated Redirects/Forwards) in web apps. It injects benign, controlled payloads pointing to example.com and never follows redirects. Instead, it observes: HTTP 3xx Location headers HTML meta refresh tags JavaScript redirects (location.href, location.assign, location.replace) If a redirect to the canary destination is detected, the tool flags the URL as vulnerable and records clear evidence. Why it’s safe No redirect following: requests are issued with redirect handling disabled Benign payloads only (https://example.com, //example.com, and encoded variants) Timeouts & optional rate limiting to avoid stressing targets No third-party services: everything runs locally in your browser Key features Test one or many URLs (paste multiple; one per line) Auto-detect common redirect parameters (next, redirect_uri, returnTo, etc.) or specify your own Choose GET or HEAD, set timeout and delay between requests View results inline and Export JSON with full evidence (status, header, mechanism) Clear legal/ethical banner; intended for authorized testing only Typical use cases Security reviews of login flows, OAuth/OIDC callbacks, and post-login redirect chains AppSec CI/spot checks during release hardening Bug bounty triage and validation How it works (high level) You paste URLs to scan The tool sets candidate redirect parameters to benign URLs (and encoded variants) It sends requests with redirect=manual and inspects response headers and HTML Findings are displayed and can be exported as JSON Notes Only test systems you own or have permission to assess You may need to whitelist targets in your testing scope and follow responsible disclosure practices open redirect, unvalidated redirect, redirect_uri, OAuth, OIDC, AppSec, bug bounty, security testing, Location header, meta refresh, JavaScript redirect, penetration testing (authorized)