Open Redirect

This is a comprehensive playbook for finding and exploiting open redirects, from basic parameter fuzzing through advanced OAuth token theft and SSRF chains. It covers the usual bypass tricks (protocol-relative URLs, userinfo abuse, backslash confusion) and the less obvious stuff like using Django's endswith validation against itself or chaining redirects through legitimate services. The OAuth section is especially detailed, showing how to leak tokens through implicit flow fragments and authorization codes. It also covers tabnabbing, which often gets forgotten. Use this when you're testing authentication flows, link preview features, or anywhere user-supplied URLs control navigation. The bypass table alone will save you from writing the same payloads repeatedly.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill open-redirect --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Open Redirect — Expert Attack Playbook

AI LOAD INSTRUCTION: Open redirect techniques. Covers parameter-based redirects, JavaScript sinks, filter bypass, and chaining with phishing, CSRF Referer bypass, OAuth token theft, and SSRF. Often underrated but critical for phishing and as a building block in multi-step exploit chains.

1. CORE CONCEPT

Open redirect occurs when an application redirects users to a URL derived from user input without validation. The trusted domain acts as a "launchpad" for phishing or token theft.

https://trusted.com/redirect?url=https://evil.com
→ User sees trusted.com in the link → clicks → lands on evil.com

2. FINDING REDIRECT PARAMETERS

Common Parameter Names

?url=           ?redirect=      ?next=          ?dest=
?destination=   ?redir=         ?return=        ?returnUrl=
?go=            ?forward=       ?target=        ?out=
?continue=      ?link=          ?view=          ?to=
?ref=           ?callback=      ?path=          ?rurl=