Agent skill · security · yaklang
open-redirect
Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.
Why this skill is useful
Provides a comprehensive playbook with specific techniques and examples for exploiting open redirect vulnerabilities, which the AI cannot generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Open Redirect — Expert Attack Playbook AI LOAD INSTRUCTION: Open redirect techniques. Covers parameter-based redirects, JavaScript sinks, filter bypass, and chaining with phishing, CSRF Referer bypass, OAuth token theft, and SSRF. Often underrated but critical for phishing and as a building block in multi-step exploit chains. 1. CORE CONCEPT Open redirect occurs when an application redirects users to a URL derived from user input without validation. The trusted domain acts as a "launchpad" for phishing or token theft. --- 2. FINDING REDIRECT PARAMETERS Common Parameter Names Server-Side Sinks Client-Side (JavaScript) Sinks --- 3. FILTER BYPASS TECHNIQUES Validation Bypass --- --- Checks if URL starts with / //evil.com (protocol-relative) Checks domain contains trusted.com evil.com?trusted.com or trusted.com.evil.com Blocks http:// //evil.com, https://evil.com, \/\/evil.com Checks URL starts with https://trusted.com https://trusted.com@evil.com (userinfo) Regex ^/[^/] (relative only) /\evil.com (backslash treated as path in some browsers) Django endswith('target.com') http://evil.com/www.target.com — URL path ends with target domain Whitelist by domain suffix Subdomain takeover on .trusted.com --- 4. EXPLOITATION CHAINS Phishing Amplification Attacker sends: https://bigbank.com/redirect?url=https://bigbank-login.evil.com Victim sees bigbank.com → clicks → enters credentials on clone site. OAuth Token Theft If OAuth redirecturi allows open redirect on the authorized domain: CSRF Referer Bypass Some CSRF protections check Referer header contains trusted domain: SSRF via Redirect When server follows redirects: --- 5. TESTING CHECKLIST --- 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/open-redirect