skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

open-redirect

Detects and exploits open redirect vulnerabilities through parameter analysis, filter bypass, and exploit chaining.

Updated Jun 5, 2026
Search Tags:#oauth#penetration testing#web security#url validation#ssrf#open redirect#filter bypass
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill open-redirect-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: open-redirect
Source: https://github.com/lNwNl/Praxis/tree/main/skills/_disabled/open-redirect
Command: npx skills add https://github.com/lNwNl/Praxis --skill open-redirect-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications often redirect users based on unvalidated URL parameters, letting attackers abuse trusted domains for phishing, OAuth token theft, and SSRF. This Skill provides a structured playbook for finding, bypassing, and chaining open redirect vulnerabilities during authorized penetration tests and CTF challenges. ## Core Features & Use Cases - Redirect Discovery: Enumerates common redirect parameters (url, next, return, callback) and identifies server-side and JavaScript navigation sinks. - Filter Bypass Techniques: Covers protocol-relative URLs, userinfo confusion, backslash tricks, double encoding, CRLF injection, and URL parser differentials between validators and browsers. - Exploit Chaining: Documents escalation paths from open redirect to phishing amplification, OAuth/OIDC token theft, CSRF Referer bypass, tabnabbing, and SSRF via redirect-following fetchers. - Use Case: During a web CTF or authorized pentest, you find /redirect?url= on a target. Use this playbook to test //evil.com, trusted.com@evil.com, and /\evil.com variants, then chain a confirmed redirect into an OAuth implicit-flow token theft scenario. ## Quick Start Ask the agent to test the target's redirect parameters for open redirect vulnerabilities and attempt filter bypass payloads from the playbook.

Frequently Asked Questions about open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for open redirect vulnerabilities?▼

Open redirect testing starts by finding URL parameters like url, next, redirect, return, or callback that control navigation. Submit an external domain such as ?url=https://evil.com and check whether the application issues a 301/302 or JavaScript redirect to it without validation.

How to bypass open redirect URL validation filters?▼

Common bypasses include protocol-relative URLs (//evil.com), userinfo confusion (trusted.com@evil.com), backslash tricks (/\evil.com), and double URL encoding. The right bypass depends on whether the validator checks prefixes, suffixes, or substring matches against an allowlist.

Can an open redirect lead to OAuth token theft?▼

Yes, when an OAuth redirect_uri allows an open redirect on the authorized domain, tokens or authorization codes can leak to an attacker URL. In implicit flow the access_token in the URL fragment is forwarded to the attacker's page after the redirect fires.

What is reverse tabnabbing and how does it work?▼

Reverse tabnabbing occurs when a link with target="_blank" lacks rel="noopener", letting the opened page access window.opener and redirect the original tab to a phishing page. Users returning to the original tab see a fake login and may enter credentials.

Why do URL parser differentials enable redirect bypass?▼

Validators and browsers parse URLs differently, so a payload like //evil.com\@trusted.com may pass an allowlist check while the browser navigates to evil.com. Exploiting these parsing gaps in userinfo, fragments, backslashes, and encoded characters defeats string-based validation.

Related Skills

Explore More Software Engineering Skills→
SkobynSkobyn

hunt-open-redirect

Identify open redirect vulnerabilities by analyzing URL parameters and testing redirect behavior.

Community
Advanced
uphiagouphiago
1.1k

hunt-open-redirect

Identify and exploit open redirect vulnerabilities across web applications.

Community
Intermediate
yhy0yhy0
74

pentest-request-forgery

Analyze web applications for CSRF, HTTP request smuggling, and CRLF injection vulnerabilities.

Community
Advanced
lNwNllNwNl

open-redirect

Detects and exploits open redirect vulnerabilities through parameter analysis, filter bypass, and exploit chaining.

Community
Intermediate