skills.rest
brukal001
brukal001COMMUNITY
Explore all skills by this author →
GitHub

open-redirect

Tests web applications for open redirect vulnerabilities using bypass techniques and chaining methods.

Updated Jun 26, 2026
Search Tags:#vulnerability#oauth#penetration testing#web security#bug bounty#open redirect#url bypass
One-click install
npx skills add https://github.com/brukal001/brukal --skill open-redirect-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: open-redirect
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/web/offensive-open-redirect
Command: npx skills add https://github.com/brukal001/brukal --skill open-redirect-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications often fail to validate user-supplied redirect URLs, letting attackers craft trusted-looking links that send victims to malicious sites. This Skill provides a structured checklist to systematically find, bypass, and escalate open redirect vulnerabilities during authorized web app testing and bug bounty hunting. ## Core Features & Use Cases - Parameter and Endpoint Discovery: Identifies common redirect parameters (redirect, url, next, return_url) and endpoints across login flows, OAuth, URL shorteners, and framework redirectors. - Bypass Technique Library: Covers domain spoofing, URL/double encoding, protocol confusion (javascript:, data:), path-based bypasses, and special character abuse to defeat validation filters. - Impact Escalation and Chaining: Shows how to chain open redirects with OAuth token theft, SSRF, XSS, and phishing for demonstrated impact. - Use Case: During a bug bounty engagement, you find a ?next= parameter on a login page. Use this Skill to test basic payloads, apply encoding and domain-spoofing bypasses against the allowlist, and chain the redirect into an OAuth token theft proof of concept. ## Quick Start Use the open-redirect skill to test https://target.com/login?next= for open redirect vulnerabilities and try bypass techniques if the basic payload is blocked.

Frequently Asked Questions about open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for open redirect vulnerabilities?▼

Identify redirect parameters like url, next, redirect, or return_url, then submit payloads such as absolute URLs (https://attacker.com), protocol-relative URLs (//attacker.com), and encoded variants. Check 3xx responses with redirects disabled to see if the Location header points to an external domain.

What are common open redirect bypass techniques?▼

Common bypasses include domain spoofing (target.com.attacker.com), URL and double encoding, protocol confusion with javascript: or data: URIs, path-based tricks like ////attacker.com, and special character abuse such as [email protected]. The right bypass depends on the target's validation logic.

Which tools help find open redirect vulnerabilities?▼

OWASP ZAP and Burp Suite scan for redirect issues, while OpenRedireX specializes in open redirect testing. Waybackurls and Param Spider help discover historical redirect endpoints and parameters, and Burp Collaborator detects blind redirects.

Can open redirects be chained with other vulnerabilities?▼

Yes. Open redirects commonly escalate into OAuth token theft via redirect_uri manipulation, SSRF by redirecting to internal services, XSS through javascript: URIs, and phishing attacks that abuse the trusted domain's credibility.

Why does my open redirect payload get blocked?▼

The application likely uses an allowlist or domain validation. Try encoding bypasses (%252F double encoding), subdomain spoofing, protocol-relative URLs, or CDN/proxy quirks where edge and origin servers decode URLs differently.

How should open redirect vulnerabilities be remediated?▼

Use server-side allowlists of permitted domains with proper URI parsing rather than string checks, restrict protocols to http/https, and prefer indirect references like numeric IDs mapped to pre-approved URLs. Adding an interstitial warning page for external redirects also reduces phishing risk.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

performing-http-parameter-pollution-attack

Tests web applications for HTTP Parameter Pollution vulnerabilities by injecting duplicate parameters to bypass validation and WAF rules.

Community
Intermediate
Wyl-cmdWyl-cmd
6

hunt-open-redirect

Detects and exploits open redirect vulnerabilities including OAuth redirect_uri bypass chains.

Community
Advanced
mccleod1290mccleod1290
1

open-redirect

Test web applications for open redirect vulnerabilities using bypass payloads and chaining techniques.

Community
Intermediate
Yenn503Yenn503
1

testing-for-open-redirect-vulnerabilities

Test web applications for open redirect vulnerabilities using bypass payloads and exploitation chains.

Community
Intermediate