Detecting and exploiting open redirections