Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.

SKILL: Open Redirect — Expert Attack Playbook AI LOAD INSTRUCTION : Open redirect techniques. Covers parameter based redirects, JavaScript sinks, filter bypass, and chaining with phishing, CSRF Referer bypass, OAuth token theft, and SSRF. Often underrated but critical for phishing and as a building block in multi step exploit chains. 1. CORE CONCEPT Open redirect occurs when an application redirects users to a URL derived from user input without validation. The trusted domain acts as a "launchpad" for phishing or token theft. 2. FINDING REDIRECT PARAMETERS Common Parameter Names Server Side Sinks Client Side (JavaScript) Sinks 3. FILTER BYPASS TECHNIQUES Validation Bypass Checks if URL starts with / //evil.com (protocol relative) Checks domain contains trusted.com evil.com?trusted.com or trusted.com.evil.com Blocks http:// //evil.com , https://evil.com , \/\/evil.com Checks URL starts with https://trusted.com https://trusted.com@evil.com (userinfo) Regex ^/[^/] (relative only) /\evil.com (backslash treated as path in some browsers) Django endswith('target.com') http://evil.com/www.target.com — URL path ends with target domain Whitelist by domain suffix Subdomain takeover on .trusted.com 4. EXPLOITATION CHAINS Phishing Amplification Attacker sends: https://bigbank.com/redirect?url=https://bigbank login.evil.com Victim sees bigbank.com → clicks → enters credentials on clone site. OAuth Token Theft If OAuth redirect uri allows open redirect on the authorized domain: CSRF Referer Bypass Some CSRF protections check Referer header contains trusted domain: SSRF via Redirect When server follows redirects: 5. TESTING CHECKLIST 6. TABNABBING (REVERSE TABNABBING) Concept When a link opens a new tab with target=" blank" WITHOUT rel="noopener" : The new page can access window.opener It can redirect the ORIGINAL page: window.opener.location = "https://phishing.com/login" User returns to "original" tab → sees fake login page → enters credentials Detection Exploitation Where to Look User generated content with links (forums, comments, profiles) target=" blank" links to external domains PDF viewers, document previews opening in new tabs 7. OPEN REDIRECT → OAUTH TOKEN THEFT (DETAILED CHAINS) 7.1 OAuth Implicit Flow In the implicit flow, the access token is returned in the URL fragment ( access token=... ). If redirect uri allows an open redirect on the authorized domain: 7.2 Authorization Code Flow The authorization code is sent as a query parameter. If the redirect chain preserves query parameters: 7.3 OIDC id token Fragment Leak 7.4 redirect uri validation bypass patterns 8. OPEN REDIRECT → SSRF CHAIN Server side redirect following When a server side component follows HTTP redirects (e.g., URL preview, link unfurler, webhook, image fetcher): Multi hop redirect for filter bypass DNS rebinding variant Scope escalation via redirect protocols Not all HTTP clients follow cross protocol redirects, but curl (default) and some libraries do. 9. URL PARSER CONFUSION FOR REDIRECT BYPASS When a redirect validation function parses the URL differently from the browser or server that ultimately processes it: Protocol relative URL Backslash confusion Userinfo section abuse Double encoding CRLF injection + redirect Fragment confusion Special characters Combined URL parser differential table Payload Validator Sees Browser Navigates To //evil.com Relative path https://evil.com \/\/evil.com Path \/\/evil.com https://evil.com //evil.com\@target.com Contains target.com https://evil.com //target.com@evil.com Starts with target.com https://evil.com /%0d%0aLocation: https://evil.com Path string Header injection → redirect //evil%252ecom evil%2ecom (not a domain) evil.com (after double decode)

open-redirect