1. Navigate to OWASP 2013 | A10 – Unvalidated Redirects and Forwards | Credits:

2. Click the ISSA Kentuckiana link available on the Credits page:

3. Switch to the Burp Proxy HTTP history tab, and find your request to the Credits page. Note that there are two query string parameters: page and forwardurl. What would happen if we manipulated the URL where the user is sent?

4. Switch to the Burp Proxy Intercept tab. Turn Interceptor on with the button Intercept is on.

5. While the request is paused, note the current value of the fowardurl parameter:

6. Replace the value of the forwardurl parameter to be https://www.owasp.org instead of the original choice of http://www.issa-kentuckiana.org:

7. Click the Forward button. Now turn Interceptor off by clicking the toggle button to Intercept is off.
8. Note how we were redirected to a site other than the one originally clicked!