New answers tagged

2

It will obfuscate the actual location of the script, but on it's own there is nothing preventing an attacker from guessing/dirbustings/etc the product.php file and accessing it directly. The attacker would have to then identify the correct parameter names (id & action). Once the attacker is accessing the file directly the rewrite rule does not apply. So ...


1

Although the captive portal doesn't technically allow anything that an attacker cannot already do with a fake hotspot, it may lure users into a false sense of security. As users expect such a portal, a fake portal can be set up in addition to the fake hotspot. It's likely that users put more trust in such a connection then in just the hotspot itself (their ...


11

What you are referring to is called a captive portal. It allows WiFi providers to authorise users, get confirmation for service agreement from them, display ads, require payment for extended usage time, etc. Its existence doesn't have security implications in itself (unless it was poorly implemented and leaking user-provided information, but that is on a ...


1

As well as malware, as already indicated in Kevin Morssink's answer, the risks include being compromised by any of the cross-domain exploits should any vulnerabilities exist on sites you trust and are possibly logged into: e.g. Cross-site scripting. Cross-site request forgery. Session fixation i.e. Client-site attacks on the sites you use. See the ...



Top 50 recent answers are included