offensive-open-redirect

Name: offensive-open-redirect
Author: SnailSploit

2.8kstars447forks

How to install offensive-open-redirect?

snailsploit/claude-red/offensive-open-redirect

$npx -y skills add SnailSploit/Claude-Red --skill offensive-open-redirect

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Open Redirect Vulnerabilities
2
3	## Metadata
4	- Skill Name: open-redirect
5	- Folder: offensive-open-redirect
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/open-redirect.md
7
8	## Description
9	Open redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`open redirect, URL redirect, redirect bypass, URL encoding bypass, CRLF, protocol handler, redirect chain, OAuth redirect, SSRF chain, open redirection`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Open Redirect Vulnerabilities
29
30	## Shortcut
31
32	- Search for redirect URL parameters. These might be vulnerable to parameter based open redirect.
33	- Search for pages that perform referer based redirect. These are candidates for a referer based open redirect.
34	- Test the pages and parameters you've found for open redirect.
35	- If the server blocks the open redirect, try the protection bypass techniques mentioned before.
36	- Brainstorm ways of using the open redirect in your other bug chains.
37
38	## Mechanisms
39
40	Open redirect vulnerabilities occur when web applications improperly validate user-supplied URLs used for redirections. These vulnerabilities allow attackers to craft links that appear legitimate but redirect victims to malicious websites. When exploited, the victim initially connects to a trusted domain, giving the malicious link an appearance of legitimacy, before being redirected to an attacker-controlled destination.
41
42	```mermaid
43	sequenceDiagram
44	participant Victim
45	participant TrustedSite
46	participant AttackerSite
47
48	Victim->>TrustedSite: Click malicious link<br/>trusted.com/redirect?url=evil.com
49	Note over TrustedSite: Inadequate URL validation
50	TrustedSite->>Victim: HTTP 302 Redirect to evil.com
51	Victim->>AttackerSite: Automatic redirect
52	AttackerSite->>Victim: Malicious content
53	```
54
55	The core technical flaws leading to open redirects include:
56
57	- Insufficient URL Validation: Failure to properly validate redirect targets
58	- Improper Allowlist Implementation: Flawed validation logic that can be bypassed
59	- Inadequate Sanitization: Incorrect handling of special characters or encoding
60	- Trusting Client-Side Input: Using user-supplied parameters for redirection without verification
61
62	### Notes
63
64	- Browsers restrict `javascript:` navigations from cross-origin contexts more, but many apps forward redirects to clients; validate server-side before emitting 3xx.
65	- OAuth/SSO stacks increasingly require exact `redirect_uri` match; test for partial/path-only allowlists and case/encoding mismatches.
66	- Mobile deep links: open redirects can escalate to app link hijack; test `intent:` URLs on Android and iOS universal link fallbacks.
67
68	### Modern Browser Behaviors
69
70	- Chrome 120+ Restrictions: Enhanced protection against cross-site redirects; test if app relies on specific redirect chains
71	- SameSite Cookie Implications: `SameSite=Lax` default affects redirect flows; test authentication state preservation
72	- Referrer-Policy Impact: `no-referrer` or `strict-origin` may break redirect detection; test logging/analytics dependencies
73	- COOP/COEP Headers: Cross-Origin-Opener-Policy can break popup-based OAuth flows
74	- Fenced Frames: New iframe replacement affects redirect chains in isolated contexts
75
76	Open redirects can exist in various implementation patterns:
77
78	- URL Parameter Redirects: Explicit redirect parameters (e.g., `?redirect=`, `?url=`, `?next=`)
79	- Path-Based Redirects: URL paths that trigger redirects (e.g., `/redirect/https://example.com`)
80	- Referer-Based Redirects: Redirects based on the HTTP Referer header
81	- Post-Authentication Redirects: Return URLs after login or authentication flows
82	- URL Shorteners: Services that redirect to expanded URLs
83	- Framework Redirector Endpoints: Dedicated redirection functionality in web frameworks
84
85	## Hunt
86
87	### Identifying Open Redirect Vulnerabilities
88
89	#### Target Discovery
90
91	1. Identify Redirection Parameters:
92	- Common redirect parameter names:
93	```
94	redirect, redirect_to, url, link, goto, return, returnTo, destination,
95	next, checkout, checkout_url, continue, return_path, return_url,
96	forward, path, redir, redirect_uri, view, img_url, image_url, load_url
97	```
98
99	2. Find Redirection Endpoints:
100	- Social login integrations
101	- Authentication flows
102	- Payment gateways
103	- "Share" functiona

People who liked this also viewed

6 picks

Type

offensive-open-redirect

2.8kstars447forks

View on GitHub

How to install offensive-open-redirect?

snailsploit/claude-red/offensive-open-redirect

$npx -y skills add SnailSploit/Claude-Red --skill offensive-open-redirect

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Open Redirect Vulnerabilities
2
3	## Metadata
4	- Skill Name: open-redirect
5	- Folder: offensive-open-redirect
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/open-redirect.md
7
8	## Description
9	Open redirect vulnerability checklist: parameter identification, bypass techniques (URL encoding, double slashes, CRLF injection, protocol handlers), chaining with OAuth/SSRF, and impact escalation paths. Use for web app testing and bug bounty open redirect discovery.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`open redirect, URL redirect, redirect bypass, URL encoding bypass, CRLF, protocol handler, redirect chain, OAuth redirect, SSRF chain, open redirection`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Open Redirect Vulnerabilities
29
30	## Shortcut
31
32	- Search for redirect URL parameters. These might be vulnerable to parameter based open redirect.
33	- Search for pages that perform referer based redirect. These are candidates for a referer based open redirect.
34	- Test the pages and parameters you've found for open redirect.
35	- If the server blocks the open redirect, try the protection bypass techniques mentioned before.
36	- Brainstorm ways of using the open redirect in your other bug chains.
37
38	## Mechanisms
39
40	Open redirect vulnerabilities occur when web applications improperly validate user-supplied URLs used for redirections. These vulnerabilities allow attackers to craft links that appear legitimate but redirect victims to malicious websites. When exploited, the victim initially connects to a trusted domain, giving the malicious link an appearance of legitimacy, before being redirected to an attacker-controlled destination.
41
42	```mermaid
43	sequenceDiagram
44	participant Victim
45	participant TrustedSite
46	participant AttackerSite
47
48	Victim->>TrustedSite: Click malicious link<br/>trusted.com/redirect?url=evil.com
49	Note over TrustedSite: Inadequate URL validation
50	TrustedSite->>Victim: HTTP 302 Redirect to evil.com
51	Victim->>AttackerSite: Automatic redirect
52	AttackerSite->>Victim: Malicious content
53	```
54
55	The core technical flaws leading to open redirects include:
56
57	- Insufficient URL Validation: Failure to properly validate redirect targets
58	- Improper Allowlist Implementation: Flawed validation logic that can be bypassed
59	- Inadequate Sanitization: Incorrect handling of special characters or encoding
60	- Trusting Client-Side Input: Using user-supplied parameters for redirection without verification
61
62	### Notes
63
64	- Browsers restrict `javascript:` navigations from cross-origin contexts more, but many apps forward redirects to clients; validate server-side before emitting 3xx.
65	- OAuth/SSO stacks increasingly require exact `redirect_uri` match; test for partial/path-only allowlists and case/encoding mismatches.
66	- Mobile deep links: open redirects can escalate to app link hijack; test `intent:` URLs on Android and iOS universal link fallbacks.
67
68	### Modern Browser Behaviors
69
70	- Chrome 120+ Restrictions: Enhanced protection against cross-site redirects; test if app relies on specific redirect chains
71	- SameSite Cookie Implications: `SameSite=Lax` default affects redirect flows; test authentication state preservation
72	- Referrer-Policy Impact: `no-referrer` or `strict-origin` may break redirect detection; test logging/analytics dependencies
73	- COOP/COEP Headers: Cross-Origin-Opener-Policy can break popup-based OAuth flows
74	- Fenced Frames: New iframe replacement affects redirect chains in isolated contexts
75
76	Open redirects can exist in various implementation patterns:
77
78	- URL Parameter Redirects: Explicit redirect parameters (e.g., `?redirect=`, `?url=`, `?next=`)
79	- Path-Based Redirects: URL paths that trigger redirects (e.g., `/redirect/https://example.com`)
80	- Referer-Based Redirects: Redirects based on the HTTP Referer header
81	- Post-Authentication Redirects: Return URLs after login or authentication flows
82	- URL Shorteners: Services that redirect to expanded URLs
83	- Framework Redirector Endpoints: Dedicated redirection functionality in web frameworks
84
85	## Hunt
86
87	### Identifying Open Redirect Vulnerabilities
88
89	#### Target Discovery
90
91	1. Identify Redirection Parameters:
92	- Common redirect parameter names:
93	```
94	redirect, redirect_to, url, link, goto, return, returnTo, destination,
95	next, checkout, checkout_url, continue, return_path, return_url,
96	forward, path, redir, redirect_uri, view, img_url, image_url, load_url
97	```
98
99	2. Find Redirection Endpoints:
100	- Social login integrations
101	- Authentication flows
102	- Payment gateways
103	- "Share" functiona

People who liked this also viewed

6 picks

Type