Strix•开放重定向
Strix 开放重定向测试手册,覆盖钓鱼跳转、OAuth 令牌窃取与白名单绕过;触发名:strix-open-redirect
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-open-redirect --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Open Redirect Open redirects enable phishing, OAuth/OIDC code and token theft, and allowlist bypass in server-side fetchers that follow redirects. Treat every redirect target as untrusted: canonicalize and enforce exact allowlists per scheme, host, and path. ## Attack Surface **Server-Driven Redirects** - HTTP 3xx Location **Client-Driven Redirects** - `window.location`, meta refresh, SPA routers **OAuth/OIDC/SAML Flows** - `redirect_uri`, `post_logout_redirect_uri`, `RelayState`, `returnTo`/`continue`/`next` **Multi-Hop Chains** - Only first hop validated ## High-Value Targets - Login/logout, password reset, SSO/OAuth flows - Payment gateways, email links, invite/verification - Unsubscribe, language/locale switches - `/out` or `/r` redirectors ## Reconnaissance ### Injection Points - Params: `redirect`, `url`, `next`, `return_to`, `returnUrl`, `continue`, `goto`, `target`, `callback`, `out`, `dest`, `back`, `to`, `r`, `u` - OAuth/OIDC/SAML: `redirect_uri`, `post_logout_redirect_uri`, `RelayState`, `state` - SPA: `router.push`/`replace`, `location.assign`/`href`, meta refresh, `window.open` - Headers: `Host`, `X-Forwarded-Host`/`Proto`, `Referer`; server-side Location echo ### Pa
- Attack Surface
- High-Value Targets
- Reconnaissance
- Injection Points
- Parser Differentials
- Encoding Bypasses
- Key Vulnerabilities
- Allowlist Evasion
- OAuth/OIDC/SAML
- Client-Side Vectors
- Reverse Proxies and Gateways
- SSRF Chaining
- Exploitation Scenarios
- OAuth Code Interception
What does the Strix•开放重定向 skill do?
Strix 开放重定向测试手册,覆盖钓鱼跳转、OAuth 令牌窃取与白名单绕过;触发名:strix-open-redirect
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-open-redirect --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.