New answers tagged

3

Yes, in a MITM scenario, an initial HTTP request is all it takes to successfully attack (if the user doesn't notice the missing HTTPS). And the only way to prevent this initial HTTP request is HTTP Strict Transport Security (HSTS). As you know, HSTS means that your server's HTTPS responses include a HSTS header telling the browser only to use HTTPS, i.e. ...


2

You should never allow redirection to a relative path that can be manipulated on the client side. As you say, it's dangerous as it potentially allows access to files outside of your webroot. A better approach is to "tag" or name the target pages and redirect to them inside your code. For example, when a user triggers a form, let it post redirpage with a ...


1

As Oldskool points out, there are other problems with this strategy. But you might also be vulnerable to header injection. From the changelog of header() PHP manual: 5.1.2: This function now prevents more than one header to be sent at once as a protection against header injection attacks. So on PHP versions before 5.1.2 you could send something ...


0

I would suggest you use share me not and Adblocker plugins The link might be just an AD or also can be clickjacking page or phishing page. Visiting that link might trigger a download of malicious file( some people put default action as download). Better not to click such links


1

In theory, you could have caught a drive by download. However, it is much more likely that you have been redirected to an advertisement page and the respective owner now rejoices about the revenue of all the sheeps clicking on funny looking links ;-) You can delete your cookies to get rid of any tracking/advertisement ones and I generally recommend ...



Top 50 recent answers are included