URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

learn more… | top users | synonyms

-1
votes
1answer
33 views

URL filtering , issues with URL

I am working on a URL filtering project . I have a database given to me which contain URLs need to be blocked (eg: a.b.com/d/e). I get uri and domain from http request. I compare what I get with my ...
0
votes
2answers
108 views

My website redirects to an unknown website [closed]

I coded my own website and uploaded to a host. Some days ago I realised that in specific page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects are: mywebsite.com/smth-> ...
0
votes
1answer
715 views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
2
votes
1answer
104 views

Ways to Redirect URLs

I'm looking for some interesting ways to redirect URLs. For example, http://example.com:@example.org will redirect to example.org. Are there any other ways to redirect/spoof URLs in a browser like ...
4
votes
2answers
215 views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
1
vote
1answer
156 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
1
vote
3answers
226 views

What information can be seen from HTTPS to HTTP?

Assuming a secured page https://google.com/redirect.php?keyword=apple which redirects the visitor to a non-secured website http://apple.com, would an eavesdropper (anyone watching over the network) be ...
0
votes
2answers
244 views

Exploiting an Open Redirect in POST body?

I have the following example POST request as part of a feedback form for a website that allows for an arbitrary value to be supplied to the "done_url" parameter, allowing for an open redirect after ...
3
votes
1answer
360 views

Web redirecting to porn site

I have quite serious case here. One day, My company missed to extend a domain name by few days. So it went to grace period. From what I know, if it went to grace period, people still able to access ...
2
votes
3answers
250 views

Should I trust URL based on file extension like this: http://example.com/image.jpg

I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe: ...
2
votes
1answer
125 views

US Department of Labor Watering Hole Attack

So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware: ...
1
vote
3answers
479 views

Implication of URL injection in an URL shortener service

EDIT There have been upvotes retracted or downvotes due to, I think, a serious misunderstanding of my question. In the following I'm not concerned about the URL leading to a site containing malware ...
4
votes
1answer
538 views

A couple of redirects after clicking in a link, what are they after?

I got an mass email from an friend containing only this link (made not clicable on purpose): http://www.casadelapiedra.com/components/com_content/id876757355.php I imagine she is got some kind of ...
2
votes
1answer
217 views

How effective is a URL scanner?

How do I test if a Link is REALLY malicious or not ? I use VirusTotal, but I suspect that it is not useful at all. To see why, please read further. I wanted to find out which side the stomach is on. ...
12
votes
3answers
621 views

URL Shortening - How to verify if it is a non-malicous URL?

Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions. If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
4
votes
1answer
534 views

Is HSTS (Strict-Transport-Security header) for HTTP or HTTPS?

Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
2
votes
1answer
391 views

Why is a link posted to Facebook going through all redirects and showing info for final page only?

Today I read a post on a Facebook-group about a "problem" with links posted to Facebook. Appearently when you post a link at Facebook, the sites goes through the redirect(s) that may be on the site ...
9
votes
3answers
748 views

Are open redirects a security concern?

Are open redirects a security concern? Google writes that: "An open redirect isn't a bug or a security flaw in and of itself—for some uses they have to be left fairly open." And Google's bounty ...
-2
votes
1answer
140 views

Need help finding out what type of url encoding is this? [closed]

I need to know what type of encoding is involved in this url string: ...
4
votes
2answers
499 views

What is the purpose of using Youtube-style alphanumeric ids as URL slugs?

I asked a question on StackOverflow on how to generate the alphanumeric/base64 resource IDs that Youtube, Instragram, and others use to identify videos/pictures/etc. Discussion led to the question of ...
3
votes
1answer
547 views

Are there any know browsers that support file URL redirection?

I've been addressing an open-redirect issue and in experimenting with the latest fix, I noticed that updating the redirect's protocol to file resulted in a blank page on the browser. That is, ...
4
votes
2answers
988 views

How to properly validate HTTP redirects?

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: Validate data from redirects (An attacker may submit malicious ...
-1
votes
2answers
181 views

What are the security advantage of new redirecting method used by Gmail and Facebook?

When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways. What are the security advantage of new redirecting method used by gmail and Facebook?
3
votes
3answers
157 views

A way to secure hyperlinks on websites

How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.? I thought about google safe browsing, projecthoneypot. Did ...
1
vote
1answer
435 views

How to determine whether the redirect link is secure or not?

I am checking about the security of redirect link, For the below link , how to determine whether it is secure? For the first link, the users are not allowed to change the url in the browser, but they ...
3
votes
3answers
561 views

URL redirection vulnerability

I've just read the following advisory at http://www.securitypentest.com/2011/02/facebook-url-redirect-vulnerability.html. In its solution section, I found a strike-through text: "Only works when your ...
27
votes
6answers
11k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
3
votes
2answers
413 views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access ...
4
votes
2answers
3k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
3
votes
3answers
1k views

sslstrip vs. privoxy redirect rule on clients

I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example. Suppose I have a privoxy proxy on my PC: user.action file (just part of it): { ...
6
votes
8answers
644 views

What is the vulnerability in my PHP code?

A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam. I've taken ...
9
votes
3answers
199 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...