New answers tagged

4

The short answer No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10: A10. Unvalidated Redirects and Forwards Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims ...


2

To add to what others have said : If you have a set of known URL's to redirect to (that you could map to an identifier), it would be much better to allow only known identifiers in the "redirect" parameter value. Then you can map the identifier to your safe, known, URL. Thanks to such a technique "all your troubles" go away. Of course if the value of ...


3

Current versions of PHP detect and prevent newline injections in the header function, see How to avoid HTTP Header Injection (new lines characters). In older versions pf PHP you could probably do something like login.php?redirect=%0D%0A%0D%0A<script>... Which would break out of the header and result in Location: <script>... And your ...


1

The first vulnerability I can think of is to pass a full URL as an argument that will redirect the user to a fake copy of the site (login.php?redirect=http://malicious.com) Aside from that, I'm sure there are several ways to prevent the redirection from happening and displaying instead malicious HTML/JavaScript. As a general rule, any URL parameter should ...


1

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 password from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))-- http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 Email from UserProfile where ...


-1

So what do you think is an attacker still able to do something with that or not? If you: Try to change the .png to .php and you get "Not found" then that means there is no fille with .php extetion on that specific link (it doesn't mean you can't). Try to see if you can upload a file of .php extensions instead of a file with .png extensions you should try ...


0

There might be cases when the file can be executed, it depends on many factors, code, server setup, etc. First of all you should Do a MIME check on the uploaded data Restrict extensions to common picture extensions


0

If your looking to completely eliminate chances of being vulnerable to XSS attacks, add this to your PHP script. When you grab the user input and insert into a variable, like this: $input = $_POST['input'];, instead of that (which is 100% vulnerable) go: $input = htmlspecialchars($_POST['input']);. Or, you can also go: htmlentities($input = ...


0

I have tried hard on same kind of bug you are talking about. But the same problem that I'm facing is, You can easily inject a cookie or Set-Cookie but Can't exploit further such as XSS, Content Injection etc. You can inject HTML content on 302 Redirection page but It doesn't make sense because very next you will get redirected to page. In this case only ...


0

For example, if a game sent a packet declaring score=99 could I then modify the packet to score=code or something similar? It all depends on how it is interpreted at the server-side end. If score is interpreted as an identifier, = as a delimiter and 99 as a numeric value, then code execution would only be possible via an overflow, should such a ...


2

It's not a terribly difficult attack to prevent. I would say prevention has more to do with the developer being security aware than it does with the complexity of preventing it. This is actually true of many security vulnerabilities. To answer your question - no, I don't think you are missing anything. It's just a matter of making sure developers are ...



Top 50 recent answers are included