defensive-open-redirect

Name: defensive-open-redirect
Availability: InStock
Author: riparino

Detect open redirect abuses and protocol-relative bypasses in web applications.

1|Updated Apr 27, 2026

Search Tags:#azure #detection #soc #kql #mde #open-redirect #sigma-rules

Ready to run

npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-open-redirect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: defensive-open-redirect
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-open-redirect
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-open-redirect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Open redirects enable phishing and OAuth token theft by abusing redirect parameters to external destinations; this skill provides detection for such abuses and guidance for remediation.

Core Features & Use Cases

Detect external redirect parameters and protocol-relative bypasses
Identify OAuth redirect chains and potential token theft vectors
Sigma rules for redirect parameter anomalies and KQL queries for Azure Application Gateway and MDE network events
Use for SOC triage and web application security workflows

Quick Start

Load this skill into Claude and begin monitoring application traffic for external redirect indicators to trigger alerts and remediation steps.

Frequently Asked Questions about defensive-open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect open redirect abuses in Azure Application Gateway logs?▼

You can detect open redirect abuses by running KQL queries against Azure Application Gateway logs to flag external redirect parameters and protocol-relative bypass attempts. This skill provides KQL coverage to identify these external destination anomalies.

Can I use KQL to hunt for OAuth token theft vectors in MDE network events?▼

Yes, you can use KQL to hunt for OAuth token theft vectors by querying MDE network events. This skill helps identify OAuth redirect chains and external redirect parameters that indicate potential token theft activity.

What is the best way to monitor web application traffic for external redirect parameters?▼

The best way to monitor web application traffic for external redirect parameters is to apply Sigma rules for anomaly detection alongside KQL queries. This combination flags suspicious redirect parameters and protocol-relative bypasses during SOC triage.

Does this skill provide Sigma rules for open redirect detection?▼

Yes, this skill provides Sigma rules specifically designed to detect open redirect anomalies. These rules flag external redirect parameters and protocol-relative bypass attempts to help application security teams identify phishing and token theft vectors.

How do I remediate open redirect vulnerabilities flagged during threat hunting?▼

To remediate open redirect vulnerabilities flagged during threat hunting, you should implement server-side allowlisting for redirect destinations. This skill provides guidance to validate flagged redirect parameters and enforce strict server-side allowlisting controls.