New answers tagged

3

I don't think there is a risk for an open redirect vulnerability, since anything after the ? will be interpreted as query parameters and not a part of the path. But you should change your code anyway, since you do not make sure that the param is actually URL-encoded. Do this with urlencode(): header('Location: ../page.php?param='.urlencode($param)); ...


-1

Short answer: Yes. Long answer: Yes, but it depends. We don't have a page.php code so we can only guess what that page does in the background. Still, any parameter sent either through POST or GET (or any other request for that matter) is allowed to be edited by end-used. So manipulation is of course possible. Read more about POST (HTTP) and HTTP if you want ...


1

Well, just by testing /slink?code=0 (a 404 error) and /slink?code=1 (LinkedIn Business Marketing Solutions), I'm guessing it's reserved for customers of LinkedIn Business Solutions. That said, I don't think it's that frequently used. I don't see much email traffic using it (I see more traffic using Hashcash, which is extraordinarily obscure.) This type of ...


1

This isn't a security issue. A 404 status is intended to inform your visitor that they have requested a resource that the server does not know about. It's very reasonable to include some help in the response. For example, many servers offer search functionality on their 404 page. If you can offer useful suggestions, you are only helping. (Of course, offering ...


3

I think the best answer here is to treat the necessary activity as a 301 (permanent) redirect. If you can anticipate misspellings and common issues and catch those in your webserver configuration (whether Apache, Nginx, or IIS), the entire activity should be completely transparent to the user. In your web application you could add some additional handling ...


0

Suggesting an "actual" URL would only be a security risk if it (and the source HTML - "view source") identified the backend technology (CMS etc.) and whether the system/CMS had any security flaws. For example, if I ran a WordPress site and saw the traditional URL formats of http://example.com/2016/05/20/my-article and the source code contained the ...


6

So I just stumbled upon this today and got a similar message: https://www.linkedin.com/slink?code=eiurEkp?61778=myname First I tried the first part: https://www.linkedin.com/slink?code=eiurEkp This ends here: http://281-inteligen.thiscontentedmotion.com/de/ihel/inteligen/ - a scammy article about somebody saying that someone said that this pill will just ...


2

It looks like your link is dead as it now redirects to https://www.linkedin.com/static?key=incomplete_request_error I'm not sure if there is a builtin mechanism that would specifically support user redirects in linkedin, but if the spammer injected HTML, they may have used meta tags to accomplish this. e.g. <meta http-equiv="refresh" ...


1

In whatever script you use to determine the URLs to offer as suggestions, filter out any admin URLs.


13

However, it led me to wonder if this is considered bad practice, as the server might expose URL's the admin of the website might not want to show publicly. This suggests that the feature is implemented by checking a list of all possible valid URLs (a list the server may not even have or be easily able to get), to include non-public ones, and comparing ...


61

If Bob is trying to type products and mistypes product, he already knows there's a URL in the website for products and so you're not telling him anything he doesn't know. If you don't suggest URLs that shouldn't be public, you won't have any issues. Why use a 404 message though, and not do an immediate redirect?


12

I would say that keeping a URL secret is not really the best security practise. You may have some links, whether it's hidden, or generated by Javascript, that will show the admin URL or whatever to anyone who takes a look at it. This is even more true for SPA (Single Page Application) applications I think. I don't think there is any point of hiding URLs of ...


2

The use of redirection pages can be for multiple reasons. Issue a warning to the user that the pages is leading outside the original site network (legal requirements sometime) Counting the usage of outgoing links Filtering of addresses Data scrapping (this list is not exhaustive) The first could be seen as a security measure, which makes the user aware ...


5

The short answer No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10: A10. Unvalidated Redirects and Forwards Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims ...


2

To add to what others have said : If you have a set of known URL's to redirect to (that you could map to an identifier), it would be much better to allow only known identifiers in the "redirect" parameter value. Then you can map the identifier to your safe, known, URL. Thanks to such a technique "all your troubles" go away. Of course if the value of ...


3

Current versions of PHP detect and prevent newline injections in the header function, see How to avoid HTTP Header Injection (new lines characters). In older versions pf PHP you could probably do something like login.php?redirect=%0D%0A%0D%0A<script>... Which would break out of the header and result in Location: <script>... And your ...


1

The first vulnerability I can think of is to pass a full URL as an argument that will redirect the user to a fake copy of the site (login.php?redirect=http://malicious.com) Aside from that, I'm sure there are several ways to prevent the redirection from happening and displaying instead malicious HTML/JavaScript. As a general rule, any URL parameter should ...



Top 50 recent answers are included