Tag Info

Hot answers tagged

37

I noticed that from a Google search, if I take the referer (www.google.com) out of the web request to changewise.biz, it does not redirect to the spam site. If I do not take the referer out, I get the spam site (and subsequent requests always get it since it is then cached in the browser). So I think it is not faulty old Google data, but something in your ...


30

Secure your cookies In settings.py put the lines SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True and cookies will only be sent via HTTPS connections. Additionally, you probably also want SESSION_EXPIRE_AT_BROWSER_CLOSE=True. Note if you are using older versions of django (less than 1.4), there isn't a setting for secure CSRF cookies. As a ...


23

I would suggest that your apache process itself is backdoored, because even access to non-existing pages with something like google\. in the referer gets redirected. E.g. like GET /this-page-does-not-exist/ HTTP/1.0 Host: www.changewise.biz Referer: foobargoogle. Just search google for 'apache backdoor redirect referer' - you will find enough reports of ...


14

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.


14

The simple answer is that you can't be 100% sure. Here are 5 browser extensions that automatically expand short URLs for you to check visually if the destination website is familiar. But even familiar sites can contain malware or other attacks like Cross Site Scripting. Google Chrome and Mozilla Firefox automatically perform checks against the Google Safe ...


10

You can start by submitting it to LongURL. That will usually give you the full destination URL. Then you can run it through other online tools like Web of Trust, and McAfee SiteAdvisor, to get an idea of what's there and if there are any known risks. However, your first question should be do you really trust the sender?


8

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff. More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one: Content-Disposition: filename="myfile.exe"


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

I had something similar a few months ago. Turns out that the problematic code was php hidden in a jpg file in the uploads folder. Go through your uploads (including dot-hidden files) and run file on each one. make sure the sheep are all sheep, and not hiding a wolf.


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...


6

One way you could approach this would be to encrypt the parameter as it's passed to the user with a key stored on the server (also for better protection consider adding a HMAC). Then when the user submits the form, decrypt the parameter (and check the HMAC if used) and use it to redirect the user. I've seen cases where the URL is just obfuscated (base64 ...


6

There are two reasons for the intermediate page: It prevents sensitive information in the url of the current page to leak to the other side in the "Refer" header because the Refer-header will now contain the url of the intermediate page only. It allows the email or social media provider to track clicks. They use this information for spam rating and might ...


6

Youtube must produce URL by which the videos can be referenced. They prefer that the URL be short. They can choose the ID in any way that they see fit, provided that it matches their constraints, in particular: The ID must be unique (no two videos may share it). The ID must "work well" with whatever indexing mechanism they internally use. Deriving the ID ...


5

I don't think you can really trust any URL just by looking at it (taking URLs in general). You could use a service like Virus Total to scan it https://www.virustotal.com/en/#url That is still not fool proof though.


5

This has nothing to do with security, really. It's about statistics and advertising. When you put in a link like this: http://example.com/foo.bar You get this: http://www.facebook.com/l.php?u=http%3A%2F%2Fexample.com%2Ffoo.bar&h=<hash> So, when you click the link, l.php verifies that the h parameter matches the u parameter for security ...


5

you should use * in your uri : sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*" instead of website.com/script/paramrewrited1/paramrewrited2


5

Yes. I guess before that point, a user didn't even have to be logged in to be redirected through Facebook. But then, for some time, the user needed to be logged in to Facebook for it to work. It is still a problem, since a quite a few people are always logged in to Facebook. Though even though a user might now have Facebook open right now, he might still be ...


4

I am not Facebook, but if I were designing their linking system my reasoning for following the links would be this: Shortlinking systems like bit.ly and tinyurl.com are ubiquitous. We need to follow the link to the end in order to scrape content from the page (images, blurb of text) to put in your feed, as well as to correlate you with others that have ...


4

You can add your website's prefix onto the url so they would go to: example.com/login.php?returnurl=profiles/home.php And in the page you would have it return to http://example.com/ and add of the return URL. (http://example.com/RETURNURLHERE)


4

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


4

The HSTS specification draft contains a chapter on the server processing model. It describes the expected behavior for secure requests: When replying to an HTTP request that was conveyed over a secure transport, an HSTS Host SHOULD include in its response message an STS header field […] And for non-secure requests: If an HSTS Host ...


4

The first link uses a redirect webpage that is detected by many antivirus products as: Sophos: Troj/Redir-O Microsoft: Trojan:HTML/BlacoleRef.A Kaspersky: Trojan.HTML.Redirector.an AntiVir: HTML/FriendLoad.A The text <h1> You are here because one of your friends <br> have invited you.<br> Page loading, please wait.... is the thing that ...


4

How could the JavaScript that redirected the users be injected into the DOL's site in the first place? From a cursory reading, it appears that the vulnerability is a simple XSS attack. What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)? It appears to be a Javascript-only attack. ...


4

Take a read of the RFC for URLs - it covers all the options including the one you mentioned.


3

The fact that it required user authentication didn't really reduce the risk much. IMO, The user most likely to be targeted by a vulnerability like this is the user that is going to be currently logged in and/or active on facebook. The vulnerability has since been patched (or so it's stated), but yes, it was still a vulnerability when it required the user ...


3

Generally speaking, no, a website cannot redirect the browser to a file: URL. This is due to special restrictions imposed by browsers on use of file: URLs. (Redirecting to a local file: URL would be mostly harmless, but this is a better-safe-than-sorry situation. It is mostly harmless, because the user is shown the contents of the file in their browser ...


3

A common practice after a form post is to redirect a user to success page: POST /my-form HTTP/1.1 Host: www.myhost.com HTTP/1.1 302 Moved Temporarily Location: https://www.myhost.com/form-success.html?message=%3Cb%3ESuccess!%3C/b%3E In this example the user is redirected to the form-success.html page, with the message of: <b>Success!</b> ...


3

Reputation - Obviously you can put a little more trust into big names like facebook.com or google.com when compared to clickhereforfreeporn.com. Reputation isn't foolproof though, sites can be hacked. However, reputable sites should (hopefully) put a little more effort into securing their stuff so I won't worry about it too much. If I do get a malware, I'll ...


3

To me it sounds like you may be experiencing people using Open Redirects (OWASP) to send your users to malicious sites without them realizing it. I would recommend trying to scan your application with: Nikto Skipfish I would not mind taking a look at your site aswell. If you can publish it to me and drop it in the comments or send an email to ...


3

This won't work very well. If you try it, you'll probably find that you are unable to browse most sites, because most sites don't offer their site through SSL (https:). The right way to defend yourself: install the HTTPS Everywhere extension for Firefox. Any time you visit a web site that is known to support https, HTTPS Everywhere will automatically ...



Only top voted, non community-wiki answers of a minimum length are eligible