https://infosec.zerobyte.id/posts/bypass-open-redirect_takeover-account/