Open Redirect Vulnerability Detection

Problem

Open redirects rarely leak data by themselves, but they often enable phishing, OAuth hijacking, SSRF chaining, and privilege-boundary abuse. During web app testing, engineers may treat Location, url, and redirect_uri as ordinary business parameters and miss differences in parameter concatenation, allowlists, protocol parsing, or double decoding. The result is a controllable redirect without a clear exploit chain.

Workflow and limits

The skill turns open redirect testing into an operational checklist for checking the current target:
- Parameter identification: locate fields that may control the destination, then review parameter concatenation, allowlists, and double decoding.
- Bypass checks: validate whether the server only filters surface strings using URL encoding, double slashes, CRLF injection, and protocol handlers.
- Escalation analysis: determine whether the redirect can connect to OAuth redirect, SSRF chain, or authenticated redirects to create a higher-impact path.
- Progress tracking: mark completed items and recommend the next step based on confirmed redirect behavior.

Use it for authorized penetration testing, internal web app review, and bug bounty triage. If the target is not explicitly authorized, the redirect is part of legitimate business configuration, or testing may affect live user sessions or external services, confirm scope before applying bypass techniques.