Have you seen my new website called Google.com?
The "filter" only reads the beginning of the value — it never asks where
the browser will actually send you. Put a trusted domain first, then the real
destination after an @:
https://stuxnet.pro/redirect/lab2/index.php?redirect=https://www.kaisec.tech@homes.com
Everything before the @ is treated as user info and
ignored; the host after it is where you land. Same trick the lesson shows with
www.google.com. Trusted prefixes on this lab: www.google.com
and (www.)kaisec.tech.