offensive-open-redirect

SKILL: Open Redirect Vulnerabilities

Metadata

• Skill Name: open-redirect
• Folder: offensive-open-redirect
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/open-redirect.md

Description

Open redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.

Trigger Phrases

Use this skill when the conversation involves any of: open redirect, URL redirect, redirect bypass, URL encoding bypass, CRLF, protocol handler, redirect chain, OAuth redirect, SSRF chain, open redirection

Instructions for Claude

When this skill is active:

1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings

---

Full Methodology

Open Redirect Vulnerabilities

Shortcut

• Search for redirect URL parameters. These might be vulnerable to parameter based open redirect.
• Search for pages that perform referer based redirect. These are candidates for a referer based open redirect.
• Test the pages and parameters you've found for open redirect.
• If the server blocks the open redirect, try the protection bypass techniques mentioned before.
• Brainstorm ways of using the open redirect in your other bug chains.

Mechanisms

Open redirect vulnerabilities occur when web applications improperly validate user-supplied URLs used for redirections. These vulnerabilities allow attackers to craft links that appear legitimate but redirect victims to malicious websites. When exploited, the victim initially connects to a trusted domain, giving the malicious link an appearance of legitimacy, before being redirected to an attacker-controlled destination.