What problem does it solve? Web applications often mishandle user-supplied redirect URLs, and manually testing every redirect parameter, encoding variant, and framework-specific endpoint is slow and error-prone. This Skill provides a structured checklist for finding and exploiting open redirect vulnerabilities during authorized security testing. ## Core Features & Use Cases - Redirect Parameter Discovery: Identifies common redirect parameters (redirect, url, next, return_url) and endpoints across authentication flows, OAuth integrations, and URL shorteners. - Bypass Technique Library: Covers domain spoofing, URL/double encoding, protocol confusion (javascript:, data:), path-based bypasses, and special character abuse to defeat validation logic. - Impact Escalation Guidance: Shows how to chain open redirects with phishing, CSRF, XSS, SSRF, and OAuth token theft to demonstrate real impact. - Use Case: During a bug bounty engagement, you find a login page with a ?next= parameter. Use this Skill to systematically test basic payloads, then encoding and domain-spoofing bypasses, and finally document a working proof of concept. ## Quick Start Use the open-redirect skill to test https://target.com/login?next= for open redirect vulnerabilities and suggest bypass payloads.
