Open redirect chains
An unvalidated next= is inventory, not a report, until it leaks an OAuth code, a session token, or feeds a server-side fetch.
Playbooks
- OAuth & SSO Misconfiguration - Abuse loose redirect and state handling in OAuth flows to steal tokens and take over accounts.
- Open Redirect Chains - Do not report the bounce. Report where the victim's code, token, or script execution goes.
Gadgets
- Open redirect - Low alone. High when it leaks an OAuth code, a session token, or feeds a server-side fetch.
- OAuth redirect_uri mismatch - A loose redirect_uri is an ATO gadget. This is one of the highest-converting chains on SSO-heavy programs.
Payloads
- Open Redirect - Escape allow-list redirect validation. Low impact alone, but chains into OAuth token theft and SSRF filter bypass. Test on redirect_uri, next, returnUrl, url, and dest params.
- OAuth / OIDC - redirect_uri tricks, implicit flow, mixed response_type, state CSRF. Pair with the OAuth playbook.
- Unicode / overlong / homoglyph - Filters that work on UTF-8 after they already made a decision on bytes, or that treat lookalike domains as the allowlist host.
Bypasses
- OAuth redirect_uri / flow tricks - Allowlists that are string-prefix checks, leftover implicit flow, and open redirects on an allowed origin.
Tools
- gf - A wrapper around grep with reusable pattern packs (xss, sqli, ssrf, lfi, redirect). Instantly slices URL lists into likely-vulnerable candidates.
Questions
Will programs pay for a bare redirect?
Some pay P4/P5. Most want the chain: OAuth code, reset token, or SSRF. Ask what it becomes.
Which parsers?
javascript:, //evil, /\evil, @evil, and startsWith allowlists are different bugs. Test all of them.
This page is the public form of hunt_brief("redirect") on the MCP connector. Authorized testing only.