URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

learn more… | top users | synonyms

0
votes
1answer
50 views

Redirect from HTTP to HTTPS; SSLStrip

Our web app home page redirects from HTTP to HTTPS. Our security consultant has told us this is a significant security weakness, that the redirect could be intercepted e.g. by SSLStrip. And therefore, ...
3
votes
2answers
63 views

Is URL redirection in PHP safe if I use ../../ as a prefix?

I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
0
votes
2answers
62 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
0
votes
0answers
10 views

Handling assertions in responses statuses 302 in ZAP

After configuring all form Authentication in ZAP, I have faced an issue to assert successful login in ZAP. The response will arrive with the status "302" moved temporary EX: > HTTP/1.1 302 ...
9
votes
2answers
1k views

Redirecting/rickrolling intruders

While browsing for Node.js packages, I came across this one. It's purpose is to redirects crawlers away from a site, and by default it Rickrolls them. I find the idea amusing, but is it a good idea to ...
-2
votes
2answers
49 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
3
votes
0answers
44 views

All Devices on Network Being Redirected to Malware Download [closed]

I have a curious problem. I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and ...
4
votes
2answers
172 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
15
votes
0answers
217 views

Bypassing HTTP to HTTPS cached 301 redirect to use SSLstrip

I'm doing some pen. tests on a HTTPS (443) server that does not have HSTS implemented (no HSTS headers on response and the address is not on Chrome HSTS preload list). The problem is that in my ...
1
vote
0answers
79 views

Google images redirects to some page with random images [closed]

My customer have some photos on images.google.com that when clicked redirects to some pages and then stops on http://imageol.com/"something" with one random image. First I thought that it was a ...
6
votes
1answer
252 views

Is an HTTP 301 redirect to HTTPS, insecure?

For a website, I force a 301 redirect from http://login.example.com to https://login.example.com using a .htaccess file. As I read in this question this still imposes a security threat. I'm wondering ...
2
votes
2answers
118 views

Is this vulnerable to an insecure URL redirection attack

I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the ...
0
votes
0answers
24 views

OAuth 2.0 client redirect endpoint security

This question is about securing the redirect endpoint on the client side at the end of an "authorization code" flow. We have designed a back-end server that handles the OAuth 2.0 authorization ...
-2
votes
1answer
72 views

Why does ikea.com always redirect to ikea china?

Background: This question has been raised here and marked as duplicate. However, it is not fully addressed. To reproduce (not exactly): Set your DNS to 180.76.76.76 (the Baidu DNS ...
5
votes
3answers
604 views

Url Shortener vulnerability

I have service like tiny URL to shorten www.example.com/[6chars] URLs. However it includes person specified sensitive information. How can I protect the URL bruteforce scanners to the detect if URL ...
2
votes
4answers
134 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
3
votes
3answers
399 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
2
votes
1answer
163 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: ...
1
vote
1answer
105 views

How do I track IPs my computer is accessing?

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
-3
votes
1answer
136 views

Bank website has extension .rf is this safe?

Does anyone know if it is ok to proceed to my bank website even if every time I type the website in it opens pages with an .rf extension? What is that extension about? The bank is Regions dot com.
1
vote
1answer
82 views

open redirect via POST? [duplicate]

HTTP Request(POST): per_page=security.stackexchange.com&order=questions&redirect=HTTP://security.stackexchange.com/ So when I record my request I get these 3 parameters and when I edited it ...
1
vote
1answer
215 views

HTTP status 302 and subsequent redirect [closed]

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a ...
5
votes
2answers
271 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
6
votes
3answers
592 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
12
votes
2answers
5k views

Sites being redirected to adult site in all devices [closed]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
0
votes
2answers
134 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
-1
votes
1answer
98 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
3
votes
1answer
808 views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): ...
2
votes
1answer
300 views

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think ...
5
votes
1answer
544 views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
5
votes
8answers
535 views

Checking “return” parameter in login page

My login page accepts the "return" parameter, which should contain URI to redirect user if he wasn't logged in and tried to access page which isn't accessible by unauthenticated users. It could be ...
1
vote
0answers
160 views

Open redirection unique token bypass

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows: Request type: GET Vulnerable Parameter: dest ...
2
votes
1answer
283 views

What is this attacker trying to accomplish?

My client is who is running a recent version of vBulletin is getting lots strange activity and I'm at a loss to explain what the attacker is trying to accomplish. The attacker registers a fake user ...
1
vote
3answers
508 views

Removing a Redirect Virus from Fedora Linux

Despite several attempts listed below certain websites are getting redirected to a certain ad website automatically, out of the blue on linux. When some website starts redirecting to this ad website ...
1
vote
1answer
73 views

Securing connection between redirect from A to B domain

I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A. The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site ...
4
votes
3answers
1k views

Unknown URL shows my website

I run a website at https://fastslots.co. I just discovered that I am getting requests from the URL https://canadaehtees.com/ that I have no affiliation with. When I load canadaehtees.com in my browser ...
2
votes
1answer
6k views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
1answer
430 views

Why add “***” in user-agent in this malicious code?

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site. $ua = $_SERVER['HTTP_USER_AGENT']; ...
1
vote
1answer
268 views

Adding hash value to user supplied URL in a web application: any security benefit?

We administer a Java web application from an external supplier where we have access to the source code. The user is able to provide an external URL which is stored in a database and later on embedded ...
5
votes
1answer
422 views

What are the risks of accepting URL param for automatic redirection?

Can anybody name all the risks of the following scenario: User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single ...
0
votes
1answer
740 views

URL Rewriting vulnerability

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. Now there is a vulnerability issue, where whoever uses this URL ...
0
votes
1answer
245 views

Detect referer check on redirect

I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met ...
1
vote
1answer
153 views

Android's Encryption mechanism

Well, according to my Android smartphone, it says the phone has been encrypted. Should I be worried if it has a malware or if I get hacked because I once clicked a link on a certain website then I ...
3
votes
1answer
97 views

Can we detect malicious redirections by retrieving the webpage's headers? [closed]

Is it possible to know if there are URL redirections (to malicious websites) by retrieving the HTTP request and response headers of the legitimate website ?
44
votes
6answers
6k views

Site is being redirected to Viagra store; all the usual suspects turn up nothing

I have a client's site (http://changewise.biz) being redirected to a Viagra store (mywifeishappy.com). We've gone through all the usual suspects but cannot find the culprit that's causing the ...
0
votes
2answers
956 views

My website redirects to an unknown website [closed]

I coded my own website and uploaded to a host. Some days ago I realised that in specific page suddenly redirects to an unknown websites, until 3-4 redirects. The redirects are: mywebsite.com/smth-> ...
0
votes
1answer
4k views

Javascript http to https redirect - how vulnerable/how secure? [duplicate]

If I had a website http://site.com redirecting to https://site.com via javascript (with a HTTP/1.1 403 Forbidden), what are the attack vectors I could be vulnerable too? Why is this not a good ...
3
votes
1answer
200 views

Ways to Redirect URLs

I'm looking for some interesting ways to redirect URLs. For example, http://example.com:@example.org will redirect to example.org. Are there any other ways to redirect/spoof URLs in a browser like ...
8
votes
2answers
1k views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
1
vote
1answer
296 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...