Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe:


As I knew using Apache Mod Rewrite attacker can redirect any URL with any extension to executable file by direct download, at that case, only Antivirus can protect user when clicked on any link, so,

What are risks of URL's generally?

How to check if the URL not a link to malware before download?

share|improve this question
up vote 11 down vote accepted

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff.

More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one:

Content-Disposition: filename="myfile.exe"

share|improve this answer
+1 for content-disposition – Filip Haglund Jul 21 '13 at 8:47

I don't think you can really trust any URL just by looking at it (taking URLs in general).

You could use a service like Virus Total to scan it

That is still not fool proof though.

share|improve this answer
Please be aware that VirusTotal is now owned by Google. Just sayin'... (insert twisted evil grin here) – Deer Hunter Jul 21 '13 at 8:26
I guess we should create a new start up! – Casey Jul 21 '13 at 15:05
  1. Reputation - Obviously you can put a little more trust into big names like or when compared to Reputation isn't foolproof though, sites can be hacked. However, reputable sites should (hopefully) put a little more effort into securing their stuff so I won't worry about it too much. If I do get a malware, I'll just let my AV deal with it or wipe my machine in the worst case scenario.

  2. Scan it with VirusTotal before clicking the URL. Obviously this is a pain in the ass and it is not something you can expect users to do before clicking on every single link in front of them. It's also not foolproof as VirusTotal cannot not detect every single piece of malware out there.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.