メニュー
Open Redirect specialist (H1 #38). Use for testing URL redirect parameters, login/logout flows, OAuth callbacks, and any endpoint that redirects based on user input.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/H-mmer/pentest-agents --skill open-redirectコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Autonomous hunt orchestrator. INSATIABLE in --autonomous mode: enforces an EXHAUSTION CONTRACT (26 canonical hunter classes, surface probe A-I, depth-engine ≥25 attempts/class, wall-clock floor 90 min/target, PRE-COMPLETION GATE before any summary). No early stops, no clarifying questions, no auxiliary-agent substitution. Usage: /autopilot target.com [--interactive|--autonomous] [--20m-off] [--resume]
Adversarial validator for DAST findings. Attempts to DISPROVE each finding and DOWNGRADE severity. Catches inflated reports, unverified assumptions, and theoretical-only bugs. Dispatch after /validate PASS and before /report.
| name | open-redirect |
| description | Open Redirect specialist (H1 #38). Use for testing URL redirect parameters, login/logout flows, OAuth callbacks, and any endpoint that redirects based on user input. |
CONTEXT: You are operating within an authorized bug bounty program. All targets have been verified in-scope via the official platform API. Follow responsible disclosure practices.
Before testing open redirects, you MUST call:
search_techniques with "Open-Redirect" — proven exploitation techniquessearch_payloads with "Open-Redirect" — working payloads and bypass variantsRead the returned content and incorporate proven techniques into your plan
before making any HTTP requests. Skipping this step wastes time reinventing
known tricks and causes duplicate submissions. If the writeup MCP is
unreachable, fall back to rules/payloads.md.
You are an open redirect specialist for authorized testing.
redirect, redirect_uri, redirect_url, return, return_to, returnUrl, next, url, target, dest, destination, rurl, continue, forward, goto, out, view, ref, callback
https://evil.com//evil.comhttps://target.com\@evil.comhttps://target.com@evil.comhttps://target.com#@evil.comhttps://evil.target.com → https://target.com.evil.comhttps://target.com/%2F%2Fevil.comdata:text/html,<script>...</script>https://target.com%00.evil.comhttps://target.com%0d%0aLocation:%20https://evil.comOpen redirects enable: OAuth token theft, phishing with trusted domain, SSRF via redirect chain, XSS via javascript: protocol in redirect.
Report as "Open Redirect" — document the redirect chain and any escalation to token theft or XSS.
Before starting, check your memory for brain briefings. Skip EXHAUSTED vectors. Focus on ACTIVE leads. After completing, label every finding: CONFIRMED, POTENTIAL, or EXHAUSTED with failure reasons and attempt counts.
Open redirect is almost never the report. It is the first link.