URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.
2
votes
1answer
102 views
US Department of Labor Watering Hole Attack
So I read this article about how the US Department of Labor's website was compromised and users were redirect to a site that installed malware:
...
1
vote
3answers
136 views
Implication of URL injection in an URL shortener service
EDIT There have been upvotes retracted or downvotes due to, I think, a serious misunderstanding of my question. In the following I'm not concerned about the URL leading to a site containing malware ...
0
votes
1answer
42 views
What would be a safe number of HTTP redirects to follow when scraping a URL until giving up? [closed]
I'm doing a "share box" where users can enter a link before posting and the app automatically scraps the URL to get a thumbnail and some other info. My question is: What would be a safe number of HTTP ...
4
votes
1answer
321 views
A couple of redirects after clicking in a link, what are they after?
I got an mass email from an friend containing only this link (made not clicable on purpose):
http://www.casadelapiedra.com/components/com_content/id876757355.php
I imagine she is got some kind of ...
2
votes
1answer
115 views
How effective is a URL scanner?
How do I test if a Link is REALLY malicious or not ? I use VirusTotal, but I suspect that it is not useful at all. To see why, please read further.
I wanted to find out which side the stomach is on. ...
11
votes
3answers
434 views
URL Shortening - How to verify if it is a non-malicous URL?
Again, I must mention that I have just started to learn about security. So, please bear with my newbie questions.
If I receive a shortened URL from somewhere, say in an my-email or in a social media ...
3
votes
1answer
211 views
Is HTST (Strict-Transport-Security header) for HTTP or HTTPS?
Is the Strict-Transport-Security header intended for HTTP or HTTPS? What I mean is, do I respond with this header on a HTTP connection which in turn tells the browser to use HTTPS only from that point ...
2
votes
1answer
224 views
Why is a link posted to Facebook going through all redirects and showing info for final page only?
Today I read a post on a Facebook-group about a "problem" with links posted to Facebook.
Appearently when you post a link at Facebook, the sites goes through the redirect(s) that may be on the site ...
9
votes
3answers
236 views
Are open redirects a security concern?
Are open redirects a security concern? Google writes that: "An open redirect isn't a bug or a security flaw in and of itself—for some uses they have to be left fairly open." And Google's bounty ...
-2
votes
1answer
87 views
Need help finding out what type of url encoding is this? [closed]
I need to know what type of encoding is involved in this url string:
...
4
votes
2answers
256 views
What is the purpose of using Youtube-style alphanumeric ids as URL slugs?
I asked a question on StackOverflow on how to generate the alphanumeric/base64 resource IDs that Youtube, Instragram, and others use to identify videos/pictures/etc. Discussion led to the question of ...
2
votes
1answer
258 views
Are there any know browsers that support file URL redirection?
I've been addressing an open-redirect issue and in experimenting with the latest fix, I noticed that updating the redirect's protocol to file resulted in a blank page on the browser.
That is, ...
4
votes
2answers
386 views
How to properly validate HTTP redirects?
I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads:
Validate data from redirects (An attacker may submit malicious ...
-1
votes
2answers
148 views
What are the security advantage of new redirecting method used by Gmail and Facebook?
When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways.
What are the security advantage of new redirecting method used by gmail and Facebook?
0
votes
0answers
289 views
Java Servlet request.getRequestURL() logged abnormal string
I had asked this question in stackexchange.com ( http://stackoverflow.com/questions/10496410/java-servlet-request-getrequesturl-logged-abnormal-string/10496937#10496937). Since this place is more ...
3
votes
3answers
132 views
A way to secure hyperlinks on websites
How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.?
I thought about google safe browsing, projecthoneypot.
Did ...
1
vote
1answer
171 views
How to determine whether the redirect link is secure or not?
I am checking about the security of redirect link, For the below link , how to determine whether it is secure?
For the first link, the users are not allowed to change the url in the browser, but they ...
3
votes
3answers
347 views
URL redirection vulnerability
I've just read the following advisory at http://www.securitypentest.com/2011/02/facebook-url-redirect-vulnerability.html. In its solution section, I found a strike-through text: "Only works when your ...
18
votes
5answers
5k views
Trying to make a Django-based site use HTTPS-only, not sure if it's secure?
The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
2
votes
2answers
305 views
When is an intermediate page needed before directing a user off my primary website? What is the best implementation?
The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example).
I've seen this used in Exchange Outlook Web Access ...
3
votes
2answers
2k views
Testing clean urls with sqlmap
Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean?
I know how to test my sites that have ...
3
votes
3answers
902 views
sslstrip vs. privoxy redirect rule on clients
I watched this video: http://www.securitytube.net/video/193 Now I'm thinking about an example.
Suppose I have a privoxy proxy on my PC:
user.action file (just part of it):
{ ...
6
votes
8answers
590 views
What is the vulnerability in my PHP code?
A website of mine was recently hacked. Although the actual website remain unchanged, they were somehow able to use the domain to create a link that re-directed to an ebay phishing scam.
I've taken ...
6
votes
3answers
176 views
Defending site against being abused by phishing
Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
