domains / families / security / open-redirect

open-redirect

separate

Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and may redirect users to attacker-controlled destinations.

When to use

• parameter-based redirects
• JavaScript sinks
• filter bypass
• chaining with phishing
• CSRF Referer bypass
• OAuth token theft
• SSRF
• tabnabbing

Skill page

Source