skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-open-redirect

Detect open redirect vulnerabilities and chain them into OAuth token theft and SSRF escalation.

Updated Sep 6, 2026
Search Tags:#oauth#penetration testing#web security#ssrf#bug bounty#account takeover#open redirect
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-open-redirect-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-open-redirect
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-open-redirect
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-open-redirect-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Open redirect vulnerabilities are often dismissed as low-impact, but when chained with OAuth flows or server-side fetching they enable account takeover and SSRF. This Skill provides a systematic methodology to discover redirect parameters, bypass filters, and escalate findings into high-severity chains. ## Core Features & Use Cases - Redirect Parameter Discovery: Extract candidate endpoints using gf patterns, grep for common parameters like redirect, next, url, returnTo, and callback from crawled URLs. - Filter Bypass Testing: Apply a payload table covering protocol-relative URLs, backslash bypasses, at-sign confusion, URL encoding, null bytes, and JavaScript/data URIs. - Impact Chaining: Escalate redirects into OAuth authorization code theft (ATO), phishing with trusted domains, session fixation, and SSRF via server-side redirect following. - Use Case: During a bug bounty engagement, you find /logout?returnTo= on the target. Use this Skill to test bypass payloads, confirm the Location header points to your domain, then chain it into the OAuth redirect_uri to steal authorization codes. ## Quick Start Hunt for open redirect vulnerabilities on the target domain and test whether any findings can be chained into the OAuth flow for account takeover.

Frequently Asked Questions about hunt-open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find open redirect vulnerabilities on a website?▼

Extract URLs containing parameters like redirect, next, url, returnTo, and callback from crawled data using gf patterns, then replace values with a controlled domain and check the Location response header with curl. Confirm the server returns a redirect to your domain without following it.

How to bypass open redirect filters and blacklists?▼

Common bypasses include protocol-relative URLs (//evil.com), backslash tricks (/\\evil.com), at-sign confusion ([email protected]), URL encoding, null bytes, and subdomain tricks like target.com.evil.com. Test each payload and inspect the Location header to see which the filter misses.

Can an open redirect lead to account takeover?▼

Yes, when chained with OAuth. If the OAuth redirect_uri accepts a URL containing an open redirect on a trusted domain, the authorization code is sent to the attacker-controlled destination, enabling account takeover. This chain typically raises severity from Low to High or Critical.

What tools automate open redirect detection?▼

openredirex tests candidate URLs against payloads in bulk, nuclei runs redirect templates at medium and high severity, and a gf plus qsreplace pipeline with curl checks redirect headers manually. All three approaches are covered in the methodology.

Why does curl miss some open redirects?▼

DOM-based redirects execute entirely in JavaScript using sinks like location.href or window.open fed from location.search or location.hash, so no Location header is ever sent. Grep JavaScript files for navigation sinks reading from URL sources and confirm behavior in a browser.

Related Skills

Explore More Software Engineering Skills→
gongzeqgongzeq

katana-crawl-web

Crawls authorized web targets to generate deduplicated candidate URLs for vulnerability scanning.

Community
Intermediate
Wyl-cmdWyl-cmd
6

hunt-open-redirect

Detects and exploits open redirect vulnerabilities including OAuth redirect_uri bypass chains.

Community
Advanced
xalgordxalgord
954

testing-for-crlf-injection

Tests web applications for CRLF injection enabling HTTP header injection and response splitting.

Community
Advanced
six2dezsix2dez
1.4k

burp-scan

Coordinate Burp Suite scans via MCP for vulnerability identification.

Community
Advanced