Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-04
Testing for Client-Side URL Redirect
Passed 17 of 21 test cases with the skill, and 15 of 21 without it.
2 fixed16 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
A QA automation engineer wants to loop over various bypass payloads against a target authentication endpoint using curl in a shell loop. The team suggests only testing full https absolute URLs. What additional bypass patterns (such as protocol-relative or authority trickery) should be iterated in the script?
| Checked | Without skill | With skill |
|---|---|---|
| Includes protocol-relative bypass payloads starting with double slashes. | Missed | Passed |
| Includes userInfo syntax bypass payloads containing the at symbol. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-04
Testing for Client-Side URL Redirect
Client-side URL redirect vulnerabilities (open redirects) occur when JavaScript redirects users based on URL parameters without validation. Attackers can craft links that redirect victims to malicious sites, facilitating phishing attacks.
#!/bin/bash
TARGET="https://target.com"
# Common redirect parameters
params=("url" "redirect" "next" "return" "returnUrl" "goto" "destination" "redir" "redirect_uri" "continue")
for param in "${params[@]}"; do
response=$(curl -sI "$TARGET/login?$param=https://evil.com" | grep -i "location")
if echo "$response" | grep -qi "evil.com"; then
test cases passed, vs 15 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.