open-redirectlisted

# SKILL: Open Redirect — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Open redirect techniques. Covers parameter-based redirects, JavaScript sinks, filter bypass, and chaining with phishing, CSRF Referer bypass, OAuth token theft, and SSRF. Often underrated but critical for phishing and as a building block in multi-step exploit chains. ## 1. CORE CONCEPT Open redirect occurs when an application redirects users to a URL derived from user input without validation. The trusted domain acts as a "launchpad" for phishing or token theft. ``` https://trusted.com/redirect?url=https://evil.com → User sees trusted.com in the link → clicks → lands on evil.com ``` --- ## 2. FINDING REDIRECT PARAMETERS ### Common Parameter Names ```text ?url= ?redirect= ?next= ?dest= ?destination= ?redir= ?return= ?returnUrl= ?go= ?forward= ?target= ?out= ?continue= ?link= ?view= ?to= ?ref= ?callback= ?path= ?rurl= ``` ### Server-Side Sinks ``` HTTP 301/302 Location header PHP: header("Location: $input") Python: redirect(input) Java: response.sendRedirect(input) Node: res.redirect(input) ``` ### Client-Side (JavaScript) Sinks ```javascript window.location = input window.location.href = input window.location.replace(input) window.open(input) document.location = input ``` --- ## 3. FILTER BYPASS TECHNIQUES | Validation | Bypass | |---|---| | Checks if URL starts with `/` | `//ev