What problem does it solve? Open redirect vulnerabilities are often dismissed as low-severity findings, yet they become critical when chained to OAuth token theft, phishing, or SSRF. This Skill provides a systematic methodology to discover redirect parameters, bypass validation filters, and escalate low-impact redirects into account-takeover chains. ## Core Features & Use Cases - Redirect Parameter Discovery: Enumerate redirect-controlling parameters (?url=, ?next=, ?redirect_uri=, ?returnTo=) across login, logout, OAuth, and payment flows using gf patterns and grep. - Bypass Payload Library: Apply a curated bypass table covering protocol-relative URLs, backslash tricks, at-sign confusion, null bytes, whitespace injection, and javascript:/data: URIs. - Chain Escalation: Pivot open redirects into OAuth auth-code theft (ATO), server-side SSRF, session fixation, and CSRF Referer bypass. - Use Case: During a bug bounty engagement, you find an OAuth authorize endpoint. Use this Skill to test whether redirect_uri accepts an open redirect on a trusted domain, capture the victim's auth code, and demonstrate full account takeover. ## Quick Start Ask the agent to hunt for open redirect vulnerabilities on the target domain, enumerate redirect parameters, test bypass payloads, and check whether any redirect can be chained into the OAuth redirect_uri flow.
