Tag Info

New answers tagged

4

According to your question Chrome was loading a plain HTTP favicon in a HTTPS page without any browser warning. Interesting. Redirecting to a plain HTTP website is not a vulnerability in itself. However, it is a security flaw if the redirect is accidental and you want your users to remain on a secure, trusted channel to your site. Script content will not ...


0

Redirection with Javascript or META tags ... You can not send a 301 status code via Javascript or META tags. Since the HTTP status code of the page will remain 200 OK ... ... Another disadvantage is that some browsers disable Javascript or META refresh. Therefore, one must include a link to the destination page in the body of the page ... URL redirection ...


1

There is indeed a vulnerability, because as you observed, an attacker could intercept the traffic on the unsecured line and change it. The reason your script didn't execute is that this came in the favicon, and Chrome (apparently) does not execute scripts in the favicon. To exploit this, you would have to get Chrome to execute the code in the favicion. ...



Top 50 recent answers are included