Let's imagine the scenario: /register?redirectUrl=//bounty,com - redirect to bounty,com Now try an XSS payload: /register?redirectUrl=javascript:alert (1) - usually blocked by WAF's Try this awesome ...