RedRip is a fast and reliable tool designed to detect Open Redirect vulnerabilities in web applications. By sending crafted payloads to a target URL parameter, it helps security researchers identify if a site improperly redirects users to attacker-controlled domains.
- Generates a wide variety of common and edge-case open redirect payloads
- Supports custom payload wordlists for tailored testing
- Detects redirects specifically to your specified target domain
- Color-coded console output for quick identification of findings
- Option to display full tested URLs for detailed review
- Ability to save scan results to a file for documentation
- Python 3.6 or higher
- Install dependencies with pip:
pip install requests coloramaRun the tool from the command line as follows:
python3 redrip.py TARGET_URL [OPTIONS]The base URL of the vulnerable redirect parameter (e.g. https://site.com/?url=)
-w/--wordlist : Path to a custom payload wordlist file -s/--save : Save results to a specified file -f/--full : Show full URLs being tested -d/--domain : Target domain to detect redirects to (e.g. evil.com) -t/--threads : Number of concurrent threads (default: 10) -mc/--match-code : Only show results with specific status code (e.g., 200) -fc/--filter-code : Filter out responses with these status codes (e.g., 403 404) -h/--help : help:)
Test a URL with default payloads and show full URLs:
python3 redrip.py "https://example.com/?url=" -fUse a custom payload list and save results:
python3 redrip.py "https://example.com/?redirect=" -w payloads.txt -s results.txtChange the target domain for redirection detection:
python3 redrip.py "https://example.com/?next=" -d malicious.comThe tool generates or loads payloads designed to trigger open redirect vulnerabilities. It appends each payload to the target URL and sends an HTTP GET request without following redirects. If the server responds with a redirect (Location header) pointing to the specified target domain, it marks the payload as successful. Output is color-coded: Green: Redirect to target domain detected Yellow: Redirect to other domains (potentially suspicious) Red: No redirect or error Optionally, results can be saved to a file for later analysis.
This tool is intended solely for authorized penetration testing and educational purposes. Unauthorized use on websites without permission is illegal and unethical.
Simon:)
To run REDRIP, make sure you have the required Python packages installed. You can install them using the provided requirements.txt file:
pip install -r requirements.txtrequests – for making HTTP requests
colorama – for colored terminal output