Tag Info

Hot answers tagged

14

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.


13

The simple answer is that you can't be 100% sure. Here are 5 browser extensions that automatically expand short URLs for you to check visually if the destination website is familiar. But even familiar sites can contain malware or other attacks like Cross Site Scripting. Google Chrome and Mozilla Firefox automatically perform checks against the Google Safe ...


10

You can start by submitting it to LongURL. That will usually give you the full destination URL. Then you can run it through other online tools like Web of Trust, and McAfee SiteAdvisor, to get an idea of what's there and if there are any known risks. However, your first question should be do you really trust the sender?


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff. More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one: Content-Disposition: filename="myfile.exe"


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...


6

One way you could approach this would be to encrypt the parameter as it's passed to the user with a key stored on the server (also for better protection consider adding a HMAC). Then when the user submits the form, decrypt the parameter (and check the HMAC if used) and use it to redirect the user. I've seen cases where the URL is just obfuscated (base64 ...


6

Youtube must produce URL by which the videos can be referenced. They prefer that the URL be short. They can choose the ID in any way that they see fit, provided that it matches their constraints, in particular: The ID must be unique (no two videos may share it). The ID must "work well" with whatever indexing mechanism they internally use. Deriving the ID ...


6

There are two reasons for the intermediate page: It prevents sensitive information in the url of the current page to leak to the other side in the "Refer" header because the Refer-header will now contain the url of the intermediate page only. It allows the email or social media provider to track clicks. They use this information for spam rating and might ...


5

This has nothing to do with security, really. It's about statistics and advertising. When you put in a link like this: http://example.com/foo.bar You get this: http://www.facebook.com/l.php?u=http%3A%2F%2Fexample.com%2Ffoo.bar&h=<hash> So, when you click the link, l.php verifies that the h parameter matches the u parameter for security ...


4

Yes. I guess before that point, a user didn't even have to be logged in to be redirected through Facebook. But then, for some time, the user needed to be logged in to Facebook for it to work. It is still a problem, since a quite a few people are always logged in to Facebook. Though even though a user might now have Facebook open right now, he might still be ...


4

I am not Facebook, but if I were designing their linking system my reasoning for following the links would be this: Shortlinking systems like bit.ly and tinyurl.com are ubiquitous. We need to follow the link to the end in order to scrape content from the page (images, blurb of text) to put in your feed, as well as to correlate you with others that have ...


4

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


4

The HSTS specification draft contains a chapter on the server processing model. It describes the expected behavior for secure requests: When replying to an HTTP request that was conveyed over a secure transport, an HSTS Host SHOULD include in its response message an STS header field […] And for non-secure requests: If an HSTS Host ...


4

The first link uses a redirect webpage that is detected by many antivirus products as: Sophos: Troj/Redir-O Microsoft: Trojan:HTML/BlacoleRef.A Kaspersky: Trojan.HTML.Redirector.an AntiVir: HTML/FriendLoad.A The text <h1> You are here because one of your friends <br> have invited you.<br> Page loading, please wait.... is the thing that ...


4

How could the JavaScript that redirected the users be injected into the DOL's site in the first place? From a cursory reading, it appears that the vulnerability is a simple XSS attack. What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)? It appears to be a Javascript-only attack. ...


3

Generally speaking, no, a website cannot redirect the browser to a file: URL. This is due to special restrictions imposed by browsers on use of file: URLs. (Redirecting to a local file: URL would be mostly harmless, but this is a better-safe-than-sorry situation. It is mostly harmless, because the user is shown the contents of the file in their browser ...


3

A common practice after a form post is to redirect a user to success page: POST /my-form HTTP/1.1 Host: www.myhost.com HTTP/1.1 302 Moved Temporarily Location: https://www.myhost.com/form-success.html?message=%3Cb%3ESuccess!%3C/b%3E In this example the user is redirected to the form-success.html page, with the message of: <b>Success!</b> ...


3

What type of information would be risky to disclose via a referrer: header? Any kind of private or sensitive information shouldn't be exposed to external websites - it all depends on your application. The most common things to consider are: session IDs (you can sometimes see them in URL params like ?PHPSESSID=....) user ids / resource ids (they may ...


3

You can add your website's prefix onto the url so they would go to: example.com/login.php?returnurl=profiles/home.php And in the page you would have it return to http://example.com/ and add of the return URL. (http://example.com/RETURNURLHERE)


3

To me it sounds like you may be experiencing people using Open Redirects (OWASP) to send your users to malicious sites without them realizing it. I would recommend trying to scan your application with: Nikto Skipfish I would not mind taking a look at your site aswell. If you can publish it to me and drop it in the comments or send an email to ...


3

This won't work very well. If you try it, you'll probably find that you are unable to browse most sites, because most sites don't offer their site through SSL (https:). The right way to defend yourself: install the HTTPS Everywhere extension for Firefox. Any time you visit a web site that is known to support https, HTTPS Everywhere will automatically ...


3

Reputation - Obviously you can put a little more trust into big names like facebook.com or google.com when compared to clickhereforfreeporn.com. Reputation isn't foolproof though, sites can be hacked. However, reputable sites should (hopefully) put a little more effort into securing their stuff so I won't worry about it too much. If I do get a malware, I'll ...


2

I had trouble installing skipfish, but NetSparker works great, thanks for the tip. However, no major security holes were found. I've come to the conclusion that I most likely enabled the wrong permissions on the site dir in the first place (+w for others). It could be that simple, couldn't it? I usually enable +w for the server, so that it can write data ...


2

If I understand your question, I believe sqlmap is not designed to deal with this situation (where the web server does not follow web standards for how to represent request parameters). So, I can think of a few options: Turn off URL rewriting. Temporarily turn off request parameter rewriting on your web server (if there's an easy way to do that), to let ...


2

The other 2 answers are excellent, but I thought I would throw this log onto the fire, too: If you are at work (or anywhere where you are using a computer that isn't 100% under your control), then you shouldn't assume any safety at all, even when using SSL. I know many large organizations that distribute their own root certificates and have an SSL ...


2

Yes, this Privoxy rule set will prevent just a plain SSLStrip attack. But it can't prevent against all attacks. Recently a certificate authority by the name of DigiNotar was compromised. DigiNotar knew they have been comprised but failed to notify the public leading to Mozilla removing them as a trusted CA. This hacker has claimed to compromised 4 other ...


2

I think what you're looking for is a Django middleware that will rewrite http to https. Something similar to what is addressed in this question on SO, where one answer points to this middleware. You'll probably have to write your own middleware, but it should be straightforward. (A well-focused question on SO will get you pointed in the right direction if ...


2

Redirecting from any http:// to the corresponding https:// page is the wrong approach. Configure nginx to redirect port 80 to https://yourdomain.ext/ server { listen 80; rewrite ^/? https://$host/ permanent; } or similar (check the next nginx manual near you) and do not run your application at all on port 80 (http). So, other requests on ...


2

A common setup will have you forwarding https traffic from your webserver (i.e. Nginx) to a local http server running the Django app. In this case it will be easier to use the SECURE_PROXY_SSL_HEADER setting (available since Django 1.4.) https://docs.djangoproject.com/en/dev/ref/settings/#std:setting-SECURE_PROXY_SSL_HEADER



Only top voted, non community-wiki answers of a minimum length are eligible