Detecting and exploiting open redirections

There are some redirections that are easy to detect – most redirections use a GET request. Others are a little more difficult to detect in simple view and need the use of the HTTP proxy to confirm them. Let's view another example:

www.testsite.com/process.php?r=otherplace.com (moidifcar por una real) 

In this kind of redirection, it is obvious that the variable is acting as flow control. Now, let's get Burp Suite to confirm the redirection and analyze it using the following steps:

1. Open the website that you think is using redirections.
2. Stop the request using the Burp Suite's Proxy, by clicking on the Intercept is on button:

3. Use the secondary click to display the options menu, and click on Send to Spider.
4. Spider is a tool included in all the HTTP proxies that works to map the applications. Spider follows all the links and redirections detected in the HTTP requests and responses to find the website's structure.
5. Go to the Spider section, clicking on the Spider...