Open Redirect Attack Playbook

What Problem It Addresses

Open redirect often appears in login callbacks, SSO flows, short links, share redirects, and redirect_uri-style parameters. The risk is not just one URL field. The issue is that an application may hand its trusted redirect capability to user-controlled input, allowing users to be sent from a legitimate entry point to an external or attacker-controlled destination. This can make phishing pages look more credible, allow sensitive Referer data to enter risky request paths, or serve as a bridge in OAuth token theft, CSRF chaining, and SSRF-style exploitation.

How The Skill Works

The skill treats open redirect as an attack playbook, organizing analysis from entry-point discovery to chained exploitation:
- Parameter entry points: inspect controlled redirect parameters such as url, next, redirect, and returnTo, and evaluate whether target host validation is strict enough.
- JavaScript sinks: review frontend navigation sinks such as location.href, window.open, and dynamically clicked <a> elements, where user input may influence the final URL.
- Filter bypass: analyze allowlists, protocol restrictions, prefix checks, and encoding boundaries to see whether filtering only blocks obvious redirects while missing equivalent forms.
- Chained abuse: connect open redirect to phishing, CSRF Referer bypass, OAuth token theft, and SSRF, then judge whether it is a standalone issue or a critical step in a larger exploit chain.

Scope And Caveats

The material is oriented toward security testing and offensive analysis. It focuses on identifying and assessing open redirect risk, not on providing a complete remediation guide. Real-world use requires clear authorization for the target system, and the knowledge should not be applied to systems without proper permission.