BSidesTLV 2026 · Bug Bounty Village

Redirected.

Open redirect in the real world - how to send a phishing email. JBL, and Haaretz three times over.

Talk by Avishai Gonen · materials below

Slides

The demo clips are below - they don't play inside the PDF.

v1 - the redirect, start to finish

A genuine Haaretz login email, clicked, redirected to my page.

v2 - the returnTo open redirect

Burp rewrites returnTo on the passwordless-login request; the magic link lands off-site.

v3 - the double-slash bypass

Published once the fix is confirmed (responsible disclosure).

JBL / HARMAN - open redirect in a recipe link; their fix fell to the @ trick. ($350, CWE-601)
Haaretz - open redirect that ships phishing from their own mail (passes SPF / DKIM / DMARC).
Haaretz, round 2 - a returnTo open redirect in the login.
Haaretz, round 3 - their fix fell to login.haaretz.co.il//attacker (a protocol-relative path).

The open-redirect bypass list from the talk.

Every finding here was reported to the vendor and fixed before publication. Nothing on this page targets a live, unpatched system.