skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

open-redirect

Detect and exploit open redirect vulnerabilities in web applications.

96|1|Updated Jun 4, 2026
Search Tags:#oauth#web-security#phishing#csrf#penetration-testing#ssrf#open-redirect
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill open-redirect-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: open-redirect
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/open-redirect
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill open-redirect-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Open redirect vulnerabilities are frequently overlooked but enable high-impact attacks including phishing, OAuth token theft, CSRF Referer bypass, and SSRF chaining, creating significant risk for web applications that accept unvalidated user-controlled redirect targets.

Core Features & Use Cases

  • Comprehensive Sink Detection: Identifies both server-side (HTTP 301/302 Location headers, server-side redirect functions) and client-side (JavaScript window.location, window.open) redirect sinks across common parameter names.
  • Filter Bypass Techniques: Covers protocol-relative, userinfo, backslash, encoding, and domain suffix bypasses for common input validation checks.
  • Exploitation Chain Guidance: Includes validated attack paths for phishing amplification, OAuth token theft, CSRF protection bypass, SSRF via server-side redirect following, and reverse tabnabbing attacks.
  • Use Case: A penetration tester can use this skill to assess an OAuth authorization flow's redirect_uri parameter to identify if an attacker can steal user authorization tokens via an open redirect vulnerability.

Quick Start

Use the open-redirect skill to test the redirect parameter on the target web application's login flow for open redirect flaws that could enable phishing attacks.

Frequently Asked Questions about open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect open redirect vulnerabilities in web applications?▼

Detect open redirect vulnerabilities by identifying unvalidated user-controlled redirect targets across server-side HTTP 301/302 Location headers and client-side JavaScript sinks like window.location. This skill scans common URL parameters to locate both server-side and client-side redirect flaws.

How can I bypass input validation filters when testing redirect parameters?▼

Bypass input validation filters on redirect parameters using protocol-relative URLs, userinfo tricks, backslash manipulations, encoding techniques, and domain suffix variations. This skill provides specific filter bypass methods to test common input validation weaknesses effectively.

Can open redirect flaws be used to steal OAuth authorization tokens?▼

Open redirect flaws enable OAuth token theft by manipulating the redirect_uri parameter in authorization flows to intercept user tokens. This skill helps assess OAuth validation paths to identify if attackers can steal credentials via vulnerable redirect endpoints.

What attacks can be chained using open redirect vulnerabilities?▼

Open redirect vulnerabilities chain into phishing amplification, CSRF Referer bypass, SSRF via server-side redirect following, and reverse tabnabbing attacks. This skill provides validated exploitation paths for developing these multi-stage attack scenarios during penetration testing.

How do I test JavaScript redirect sinks for client-side open redirects?▼

Test JavaScript redirect sinks by analyzing client-side functions like window.location and window.open for unvalidated user input. This skill identifies client-side redirect sinks alongside server-side Location headers to ensure comprehensive vulnerability coverage.

Does this open redirect detection tool work for bug bounty workflows?▼

This open redirect detection tool supports bug bounty workflows by analyzing URL parameters, testing OAuth flow validation, and mapping exploitation paths. It applies directly to security assessment and penetration testing tasks involving redirect vulnerability identification.

Related Skills

Explore More Software Engineering Skills→
Prohao42Prohao42
120

open-redirect

Identify open redirect vulnerabilities by analyzing URL parameters and sinks.

Community
Advanced
utsavthakurutsavthakur

open-redirect

Detect open redirect vulnerabilities from URL parameter manipulation.

Community
Advanced
balsm-healthbalsm-health
2

exploiting-server-side-request-forgery

Automate SSRF vulnerability testing and exploitation during authorized penetration tests.

Official
Advanced
DorianGalloDorianGallo
5

open-redirect

Identify and exploit open redirect vulnerabilities via URL parameters and navigation sinks.

Community
Advanced