BSidesTLV 2026 · Bug Bounty Village
Redirected.
Open redirect in the real world - how to send a phishing email.
About me
Avishai Gonen
Avishai Gonen
A cyber security researcher. In my free time I do CTFs, bug bounty, and independent research. 30+ CVEs to my name, found as a vulnerability researcher at Pluto Security.
https://avishaigonen123.github.io
https://www.linkedin.com/in/avishai-gonen-997148289
Agenda
Open redirect, in 60 seconds
JBL: finding → fix → bypass
DEMO
Haaretz: from open redirect to phishing
DEMO
Haaretz, round 2: the newly found one
DEMO
Haaretz, round 3: a bypass of their fix
LIVE DEMO
Open redirect
A redirect you control
A site takes its destination from user input and sends you there - without checking where.
site.com/login?next=evil.com
302
evil.com
Open redirect
JBL
Haaretz
Why it matters
Everyone underrates it
Triage calls it low severity
But it sends phishing from a domain users trust
For hunters: a fast, common, low-hanging find
OWASP Top 10 2013 · A10 · CWE-601
Open redirect
JBL
Haaretz
Case 01
JBL logoYesWeHack bounty card: $350, Open Redirect CWE-601, CVSS 4.7 Medium
Open redirect
JBL
Haaretz
demo
The report - YesWeHack
Open redirect
JBL
Haaretz
JBL · theory
Bypass techniques
The @ trick
trusted.com@evil.com
Subdomain
trusted.com.evil.com
Protocol-relative
//evil.com
Backslash
https:/\evil.com
Fragment
trusted.com#@evil.com
Encoded slash
trusted.com%2f@evil.com
Open redirect
JBL
Haaretz
demo
Breaking the fix
https://www.jbl.com@evil.com
Filter sees jbl.com. Browser goes to evil.com.
Open redirect
JBL
Haaretz
Case 01 · recap
JBL, in short
An open redirect in a recipe-link email
Reported, fixed, then bypassed with the @ trick
$350 · CWE-601 · rated medium
Lesson: sell the impact, verify the fix
Open redirect
JBL
Haaretz
Case 02
Haaretz logo
Haaretz
TheMarker logo
TheMarker
A phishing email that really came Haaretz.
Open redirect
JBL
Haaretz
demo
Watch this.
How I phished Ran Bar Zik.
Message from Ran Bar Zik: it is more than fine, anyone can fall for phishing, I'm not Superman
Open redirect
JBL
Haaretz
Sign in - and it emails you
Haaretz sign-in page: a single email field and a continue button
The mail is really from Haaretz. The link inside is mine.
Open redirect
JBL
Haaretz
demo
The redirect, start to finish
v1 demo: a genuine Haaretz email arrives, the link is clicked, and the browser is redirected to an attacker-controlled page
Open redirect
JBL
Haaretz
Haaretz · v2
A year later, I found another.
Open redirect
JBL
Haaretz
Demo
The returnTo redirect
Burp Suite intercepting the Haaretz passwordless-login request and rewriting the returnTo parameter to an attacker-controlled page
returnTo = my page
login email → confirmation → my page
Open redirect
JBL
Haaretz
I reported it. They fixed it.
WhatsApp thread with the Haaretz CTO confirming a fix is being shipped; phone number redacted
The CTO confirmed the fix - in the thread.
Reported, acknowledged, shipped.
Open redirect
JBL
Haaretz
https://login.haaretz.co.il//avishaigonen123.github.io
Burp Intruder results: one payload row returns a larger response (length 1185) than every other, which all return 1088
Open redirect
JBL
Haaretz
demo · v3
Then one payload passed
v3 demo: returnTo set to https://login.haaretz.co.il//google.com passes the fix and redirects the login flow to google.com
login.haaretz.co.il//google.com
Host check passes. The redirect uses the path - and // is protocol-relative.
Found while proving v2 was dead. Reported again.
Open redirect
JBL
Haaretz
Live demo · hands on
WhatsApp thread with the Haaretz CTO confirming the double-slash bypass is fixed; phone number redacted
Today? Blocked.
Reported again - even the // bypass now returns 400.
The CTO confirmed the v3 fix shipped - in the thread.
Open redirect
JBL
Haaretz
What we saw
JBL - an open redirect that sends phishing from jbl.com ($350, CWE-601).
JBL - they “fixed” it; the @ trick walked right through.
Haaretz - an open redirect that sends phishing from haaretz.com.
Haaretz, round 2 - another open redirect in the login, reported and fixed.
Haaretz, round 3 - their fix fell to a double-slash, found live and reported again.
Questions?
QR code to the talk materials page
Slides & demos
QR code to avishaigonen123.github.io
Website
QR code to linkedin.com/in/avishai-gonen-997148289
LinkedIn
Thank you.