URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

learn more… | top users | synonyms

2
votes
2answers
106 views

What risks do I have now that I accidentaly opened a suspicious URL send to me by Skype?

The following URL was sent to me by a trusted Skype contact (from my university): WARNING - DO NOT CLICK IF YOU DON'T KNOW WHAT YOU'RE DOING http://bit.ly/28PPw3V#dahubas=my_skype_id I clicked on ...
0
votes
3answers
657 views

Removing a Redirect Virus from Fedora Linux

Despite several attempts listed below certain websites are getting redirected to a certain ad website automatically, out of the blue on linux. When some website starts redirecting to this ad website ...
4
votes
1answer
57 views

How can Google search change the location in a URL tooltip?

When hovering over a website link in Google search the tooltip says the link of the website (stackoverflow.com). But when I click it it goes to some Google page and then StackOverflow. But now if I go ...
-1
votes
1answer
43 views

Spammer uses foreign domain for redirection [duplicate]

A friend of mine's Skype was "infected" with a bot that sends links to it's friends. The link points to LinkedIn, but as soon as you make a GET request, it redirects you to an advertising page. This ...
13
votes
3answers
2k views

How are spammers using LinkedIn “http://linkedin.com/slink?code=…” URLs?

I was sent this kind of link from presumably compromised Skype account, via a skype message (do not click unless you have a sandbox or something to protect you): https://www.linkedin.com/slink?code=...
0
votes
2answers
105 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
3
votes
1answer
8k views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of https://...
6
votes
2answers
442 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
0
votes
0answers
103 views

Why can't I redirect my https:// domain to another https:// domain on the same IP address without a security exception? [migrated]

After some internet searches, I've determined that the HTTP request sent before the SSL connection dictates to the browser which IP address the domain is registered against. As a result, any forced ...
-5
votes
1answer
102 views

Avira Antivirus acting as a virus [closed]

I have a Avira Antivirus installed on Windows 7. The problem is now when I click on any button or click to uninstall any program it redirects me to the Avira website where it says upgrade it for more ...
1
vote
2answers
97 views

Is header('Location: ../page.php?param='.$param); vulnerable to unvalidated redirects?

I have reviewed a web application built on PHP. It redirects to different pages this way: $param = $_POST['param']; header('Location: ../page.php?param='.$param); Is it vulnerable to unvalidated ...
43
votes
7answers
8k views

Is suggesting a correct url in a 404 page bad practice?

I'm currently writing a web application, and my client asked me if it would be possible to suggest a valid URL to the user when they accidentally write a typo in the URL bar, an example of this would ...
6
votes
3answers
2k views

Unknown URL shows my website

I run a website at https://fastslots.co. I just discovered that I am getting requests from the URL https://canadaehtees.com/ that I have no affiliation with. When I load canadaehtees.com in my browser ...
0
votes
1answer
37 views

On Mozilla's Add-ons site (AMO) what is happening with external links?

On Mozilla's Add-ons site (known as AMO), all external links are directed through: https://outgoing.mozilla.org/v1/[UUID]/[destination URL] As a random example, see the link in the Description ...
5
votes
4answers
386 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
24
votes
2answers
653 views

Bypassing HTTP to HTTPS cached 301 redirect to use SSLstrip

I'm doing some pen. tests on a HTTPS (443) server that does not have HSTS implemented (no HSTS headers on response and the address is not on Chrome HSTS preload list). The problem is that in my ...
0
votes
2answers
110 views

Security concerns when using nginx as a lightweight URL shortener

I wish to use nginx as a lightweight URL shortener. To be exact, assuming my domain name is example.com, I have this most basic nginx.conf: events {} http { server { listen 80; location = /...
7
votes
4answers
255 views

Bank website forwards to false site - formatted hard drive - still forwards

Summary: When I visit my bank's website, I get forwarded to a phishing mirror site. This has persisted through a re-format of my MacBook. Even on different browsers! Other computers on the same ...
3
votes
0answers
97 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
0
votes
0answers
20 views

Relative paths in Tomcat

I want to develop a web application that has a public and a restricted area. app/public app/private Public access to the web application is permitted through the app.com domain. There shall be a ...
0
votes
0answers
56 views

Domain redirection when using Evil Twin method?

When clients are connected to my fake access point, is there a way to redirect their requests to a different domain (eg.: google.com --> hotmail.com)? Could this be achieved maybe via iptables or the ...
0
votes
1answer
130 views

Redirect from HTTP to HTTPS; SSLStrip

Our web app home page redirects from HTTP to HTTPS. Our security consultant has told us this is a significant security weakness, that the redirect could be intercepted e.g. by SSLStrip. And therefore, ...
3
votes
2answers
112 views

Is URL redirection in PHP safe if I use ../../ as a prefix?

I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
0
votes
2answers
96 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
0
votes
0answers
28 views

Handling assertions in responses statuses 302 in ZAP

After configuring all form Authentication in ZAP, I have faced an issue to assert successful login in ZAP. The response will arrive with the status "302" moved temporary EX: > HTTP/1.1 302 ...
9
votes
2answers
1k views

Redirecting/rickrolling intruders

While browsing for Node.js packages, I came across this one. It's purpose is to redirects crawlers away from a site, and by default it Rickrolls them. I find the idea amusing, but is it a good idea to ...
-2
votes
2answers
63 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
3
votes
0answers
65 views

All Devices on Network Being Redirected to Malware Download [closed]

I have a curious problem. I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and ...
4
votes
2answers
545 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
1
vote
0answers
174 views

Google images redirects to some page with random images [closed]

My customer have some photos on images.google.com that when clicked redirects to some pages and then stops on http://imageol.com/"something" with one random image. First I thought that it was a virus,...
6
votes
1answer
580 views

Is an HTTP 301 redirect to HTTPS, insecure?

For a website, I force a 301 redirect from http://login.example.com to https://login.example.com using a .htaccess file. As I read in this question this still imposes a security threat. I'm wondering ...
2
votes
2answers
133 views

Is this vulnerable to an insecure URL redirection attack

I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the ...
0
votes
0answers
67 views

OAuth 2.0 client redirect endpoint security

This question is about securing the redirect endpoint on the client side at the end of an "authorization code" flow. We have designed a back-end server that handles the OAuth 2.0 authorization ...
1
vote
4answers
143 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
6
votes
2answers
1k views

Web redirecting to porn site

My company missed to extend a domain name by few days, so it went to grace period. From what I know, if it went to grace period, people would still be able to access my website. However, the site was ...
-2
votes
1answer
109 views

Why does ikea.com always redirect to ikea china?

Background: This question has been raised here and marked as duplicate. However, it is not fully addressed. To reproduce (not exactly): Set your DNS to 180.76.76.76 (the Baidu DNS http://dudns....
6
votes
3answers
696 views

Url Shortener vulnerability

I have service like tiny URL to shorten www.example.com/[6chars] URLs. However it includes person specified sensitive information. How can I protect the URL bruteforce scanners to the detect if URL ...
3
votes
3answers
534 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
2
votes
1answer
370 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: <html&...
1
vote
1answer
121 views

How do I track IPs my computer is accessing?

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
9
votes
4answers
10k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
-3
votes
1answer
160 views

Bank website has extension .rf is this safe?

Does anyone know if it is ok to proceed to my bank website even if every time I type the website in it opens pages with an .rf extension? What is that extension about? The bank is Regions dot com.
1
vote
1answer
101 views

open redirect via POST? [duplicate]

HTTP Request(POST): per_page=security.stackexchange.com&order=questions&redirect=HTTP://security.stackexchange.com/ So when I record my request I get these 3 parameters and when I edited it ...
1
vote
1answer
318 views

HTTP status 302 and subsequent redirect [closed]

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a ...
49
votes
7answers
34k views

Trying to make a Django-based site use HTTPS-only, not sure if it's secure?

The EFF recommends using HTTPS everywhere on your site, and I'm sure this site would agree. When I asked a question about using Django to implement HTTPS on my login page, that was certainly the ...
6
votes
3answers
712 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
12
votes
2answers
6k views

Sites being redirected to adult site in all devices [closed]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
0
votes
2answers
196 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
-1
votes
1answer
110 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
3
votes
1answer
1k views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): if(!isset($...