Tag Info

Hot answers tagged

37

I noticed that from a Google search, if I take the referer (www.google.com) out of the web request to changewise.biz, it does not redirect to the spam site. If I do not take the referer out, I get the spam site (and subsequent requests always get it since it is then cached in the browser). So I think it is not faulty old Google data, but something in your ...


32

Secure your cookies In settings.py put the lines SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True and cookies will only be sent via HTTPS connections. Additionally, you probably also want SESSION_EXPIRE_AT_BROWSER_CLOSE=True. Note if you are using older versions of django (less than 1.4), there isn't a setting for secure CSRF cookies. As a ...


23

I would suggest that your apache process itself is backdoored, because even access to non-existing pages with something like google\. in the referer gets redirected. E.g. like GET /this-page-does-not-exist/ HTTP/1.0 Host: www.changewise.biz Referer: foobargoogle. Just search google for 'apache backdoor redirect referer' - you will find enough reports of ...


20

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer. What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple ...


15

The simple answer is that you can't be 100% sure. Here are 5 browser extensions that automatically expand short URLs for you to check visually if the destination website is familiar. But even familiar sites can contain malware or other attacks like Cross Site Scripting. Google Chrome and Mozilla Firefox automatically perform checks against the Google Safe ...


14

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.


10

You can start by submitting it to LongURL. That will usually give you the full destination URL. Then you can run it through other online tools like Web of Trust, and McAfee SiteAdvisor, to get an idea of what's there and if there are any known risks. However, your first question should be do you really trust the sender?


8

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff. More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one: Content-Disposition: filename="myfile.exe"


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

you should use * in your uri : sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*" instead of website.com/script/paramrewrited1/paramrewrited2


8

I had something similar a few months ago. Turns out that the problematic code was php hidden in a jpg file in the uploads folder. Go through your uploads (including dot-hidden files) and run file on each one. make sure the sheep are all sheep, and not hiding a wolf.


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...


6

One way you could approach this would be to encrypt the parameter as it's passed to the user with a key stored on the server (also for better protection consider adding a HMAC). Then when the user submits the form, decrypt the parameter (and check the HMAC if used) and use it to redirect the user. I've seen cases where the URL is just obfuscated (base64 ...


6

There are two reasons for the intermediate page: It prevents sensitive information in the url of the current page to leak to the other side in the "Refer" header because the Refer-header will now contain the url of the intermediate page only. It allows the email or social media provider to track clicks. They use this information for spam rating and might ...


6

Youtube must produce URL by which the videos can be referenced. They prefer that the URL be short. They can choose the ID in any way that they see fit, provided that it matches their constraints, in particular: The ID must be unique (no two videos may share it). The ID must "work well" with whatever indexing mechanism they internally use. Deriving the ID ...


5

I don't think you can really trust any URL just by looking at it (taking URLs in general). You could use a service like Virus Total to scan it https://www.virustotal.com/en/#url That is still not fool proof though.


5

This has nothing to do with security, really. It's about statistics and advertising. When you put in a link like this: http://example.com/foo.bar You get this: http://www.facebook.com/l.php?u=http%3A%2F%2Fexample.com%2Ffoo.bar&h=<hash> So, when you click the link, l.php verifies that the h parameter matches the u parameter for security ...


5

Yes. I guess before that point, a user didn't even have to be logged in to be redirected through Facebook. But then, for some time, the user needed to be logged in to Facebook for it to work. It is still a problem, since a quite a few people are always logged in to Facebook. Though even though a user might now have Facebook open right now, he might still be ...


5

This looks a lot like a cross-site request forgery website, trying to lure visitors in executing requests to your site without them knowing they are actually sending requests to your domain. Imagine for example that 'https://canadaehtees.com' has a button on his site 'place free bet'. In case a visitor clicks that button (or automatically triggers the ...


4

I am not Facebook, but if I were designing their linking system my reasoning for following the links would be this: Shortlinking systems like bit.ly and tinyurl.com are ubiquitous. We need to follow the link to the end in order to scrape content from the page (images, blurb of text) to put in your feed, as well as to correlate you with others that have ...


4

You can add your website's prefix onto the url so they would go to: example.com/login.php?returnurl=profiles/home.php And in the page you would have it return to http://example.com/ and add of the return URL. (http://example.com/RETURNURLHERE)


4

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


4

The HSTS specification draft contains a chapter on the server processing model. It describes the expected behavior for secure requests: When replying to an HTTP request that was conveyed over a secure transport, an HSTS Host SHOULD include in its response message an STS header field […] And for non-secure requests: If an HSTS Host ...


4

The first link uses a redirect webpage that is detected by many antivirus products as: Sophos: Troj/Redir-O Microsoft: Trojan:HTML/BlacoleRef.A Kaspersky: Trojan.HTML.Redirector.an AntiVir: HTML/FriendLoad.A The text <h1> You are here because one of your friends <br> have invited you.<br> Page loading, please wait.... is the thing that ...


4

How could the JavaScript that redirected the users be injected into the DOL's site in the first place? From a cursory reading, it appears that the vulnerability is a simple XSS attack. What technology was used the exploit the memory vulnerability in Internet Explorer (i.e. JavaScript, JAVA, Flash, etc)? It appears to be a Javascript-only attack. ...


4

While multiple vulnerabilities exist in OpenX, there just isn't enough information in this case to tell for certain if your site was hacked or not. It appears from what you said that the company from whom you bought your domain simply redirected your DNS records to a porn server after you stopped paying. And then when you paid again, they redirected you ...


4

Take a read of the RFC for URLs - it covers all the options including the one you mentioned.


4

It could be due to a (previous) bad code or to avoid warnings/errors in responses. stripos returns the possition of second parameter in first one, starting indexes at 0, so in a bad code if (stripos($ua,'android')) the condition would be skipped as false in the case the string started with android. Correct solution would be using === and !==, but ...


3

The fact that it required user authentication didn't really reduce the risk much. IMO, The user most likely to be targeted by a vulnerability like this is the user that is going to be currently logged in and/or active on facebook. The vulnerability has since been patched (or so it's stated), but yes, it was still a vulnerability when it required the user ...


3

Generally speaking, no, a website cannot redirect the browser to a file: URL. This is due to special restrictions imposed by browsers on use of file: URLs. (Redirecting to a local file: URL would be mostly harmless, but this is a better-safe-than-sorry situation. It is mostly harmless, because the user is shown the contents of the file in their browser ...



Only top voted, non community-wiki answers of a minimum length are eligible