Hot answers tagged

50

Secure your cookies In settings.py put the lines SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True and cookies will only be sent via HTTPS connections. Additionally, you probably also want SESSION_EXPIRE_AT_BROWSER_CLOSE=True. Note if you are using older versions of django (less than 1.4), there isn't a setting for secure CSRF cookies. As a ...


38

I noticed that from a Google search, if I take the referer (www.google.com) out of the web request to changewise.biz, it does not redirect to the spam site. If I do not take the referer out, I get the spam site (and subsequent requests always get it since it is then cached in the browser). So I think it is not faulty old Google data, but something in your ...


23

I would suggest that your apache process itself is backdoored, because even access to non-existing pages with something like google\. in the referer gets redirected. E.g. like GET /this-page-does-not-exist/ HTTP/1.0 Host: www.changewise.biz Referer: foobargoogle. Just search google for 'apache backdoor redirect referer' - you will find enough reports of ...


21

If your devices can connect to the internet (without redirection to Adulttube.info) through 3/4G then I suppose your router is infected with a trojan (Trojan:32/DNSChanger) https://www.f-secure.com/v-descs/dnschang.shtml Trojan :32/DNSChanger compromised the router weak default password using brute-force attacks. The Trojan then changed the routers DNS ...


20

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer. What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple ...


17

The simple answer is that you can't be 100% sure. Here are 5 browser extensions that automatically expand short URLs for you to check visually if the destination website is familiar. But even familiar sites can contain malware or other attacks like Cross Site Scripting. Google Chrome and Mozilla Firefox automatically perform checks against the Google Safe ...


16

Unvalidated redirects do not necessarily apply here. An unvalidated redirect is something more along the lines of an attacker being able to send a victim to a destination of the attacker's choosing. If you read the example on the OWASP page you linked at the bottom, you will see that the attacker crafts a URL that can be sent to a victim using social ...


15

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.


13

You should use * in your URI, creating URI injection point(s). So instead of using: sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2" use: sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*" See sqlmap wiki for more usage options. From that page: URI injection point There are special cases when injection point is ...


12

Since you're doing a 301 redirect over HTTP, someone could man-in-the-middle that connection and redirect you anywhere they wanted - in particular they could actually not redirect you at all, and instead get between your computer and https://login.example.com, monitoring your connection and serving you its contents under the name http://login.example.com ...


11

You can start by submitting it to LongURL. That will usually give you the full destination URL. Then you can run it through other online tools like Web of Trust, and McAfee SiteAdvisor, to get an idea of what's there and if there are any known risks. However, your first question should be do you really trust the sender?


9

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff. More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one: Content-Disposition: filename="myfile.exe"


9

The Majestic project is a distributed web crawler, which explains why you get such a lot of different source IP addresses. It is not malicious, that is it does not attack your site and it does not even uses lots of resources (800 requests a day is not much). Like most proper bots Majestic even includes a URL in the user-agent string and if you visit this ...


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

I had something similar a few months ago. Turns out that the problematic code was php hidden in a jpg file in the uploads folder. Go through your uploads (including dot-hidden files) and run file on each one. make sure the sheep are all sheep, and not hiding a wolf.


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...


7

The HSTS specification draft contains a chapter on the server processing model. It describes the expected behavior for secure requests: When replying to an HTTP request that was conveyed over a secure transport, an HSTS Host SHOULD include in its response message an STS header field […] And for non-secure requests: If an HSTS Host ...


7

Well Simple answer. DO NOT EVER INCLUDE ANY KIND OF PERSONAL INFORMATION INTO URL. URL is extremely easy to get from outside (e.g. javascript, screenshot, etc etc) and it should never, ever include personal information. It's like using a Social Security Number as your license plate number. You technically can block bruteforce scanners by adding checks ...


6

One way you could approach this would be to encrypt the parameter as it's passed to the user with a key stored on the server (also for better protection consider adding a HMAC). Then when the user submits the form, decrypt the parameter (and check the HMAC if used) and use it to redirect the user. I've seen cases where the URL is just obfuscated (base64 ...


6

There are two reasons for the intermediate page: It prevents sensitive information in the url of the current page to leak to the other side in the "Refer" header because the Refer-header will now contain the url of the intermediate page only. It allows the email or social media provider to track clicks. They use this information for spam rating and might ...


6

Youtube must produce URL by which the videos can be referenced. They prefer that the URL be short. They can choose the ID in any way that they see fit, provided that it matches their constraints, in particular: The ID must be unique (no two videos may share it). The ID must "work well" with whatever indexing mechanism they internally use. Deriving the ID ...


6

While multiple vulnerabilities exist in OpenX, there just isn't enough information in this case to tell for certain if your site was hacked or not. It appears from what you said that the company from whom you bought your domain simply redirected your DNS records to a porn server after you stopped paying. And then when you paid again, they redirected you ...


6

It took me a while to understand what you mean by ".rf extension". Answer is: this has nothing whatsoever to do with security. The string that is displayed by your browser is a URL; it contains the protocol to use (https://), the server name (here www.regions.com), and then the path, which is a reference to some resource within that server. The point of the ...


5

I don't think you can really trust any URL just by looking at it (taking URLs in general). You could use a service like Virus Total to scan it https://www.virustotal.com/en/#url That is still not fool proof though.


5

This has nothing to do with security, really. It's about statistics and advertising. When you put in a link like this: http://example.com/foo.bar You get this: http://www.facebook.com/l.php?u=http%3A%2F%2Fexample.com%2Ffoo.bar&h=<hash> So, when you click the link, l.php verifies that the h parameter matches the u parameter for security ...


5

Yes. I guess before that point, a user didn't even have to be logged in to be redirected through Facebook. But then, for some time, the user needed to be logged in to Facebook for it to work. It is still a problem, since a quite a few people are always logged in to Facebook. Though even though a user might now have Facebook open right now, he might still be ...


5

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


5

This looks a lot like a cross-site request forgery website, trying to lure visitors in executing requests to your site without them knowing they are actually sending requests to your domain. Imagine for example that 'https://canadaehtees.com' has a button on his site 'place free bet'. In case a visitor clicks that button (or automatically triggers the ...


5

The best way is to create a whitelist of possible URLs, if the redirect is not part of the whitelist you can redirect to a default home page. However this isn't too flexible. You can also regex the whole thing so it ensures the start of the URI is your website e.g. http://example.com/ and that what which comes after your last / only contains numbers, ...


5

As there are other sites on the same server as your website showing the same behaviour (like for example: http://annihilatethehero.com/ vs. https://annihilatethehero.com/) I assume you have your webspace from a shitty reseller who configured only one ssl-page on the server: The Page of the Shanto-Mariam University of Creative Technology So any connection ...



Only top voted, non community-wiki answers of a minimum length are eligible