4

I am doing a penetration test on a web application and it is using window.history.back() to go back to the previous page. Is this safe to use?

For example, if I visit google.com and then go to the web application and then press back, it would present me with google.com again. Similarly, if an attacker could somehow simulate this in an iframe (if that gets stored in the window's history) or if the user visits the URL (but that would be pointless) or possibly alter some sort of caching mechanism. What real ways are there to exploit this?

Is this an actual issue or am I overthinking?

3

You can read about windows.history Mozilla website. Briefly it explains that history.back() is not different than clicking on the back button in your browser I think that you are overthinking about windows.history.back, but not about window.history object itself!.
If I explain in detail it would be out of the topic, however, I can shortly claim that window.history.pushState() or window.history.replaceState() methods are more worth to worry about. The browser history manipulation is possible. You can also check out about it from : Manipulating the browser history

|improve this answer|||||
1

If a page has a link that window.history.back(), it may be open to attacks that abuse the trust a user places in the links within the web application. A form of open redirect is possible. When a user visits an attacker's site that redirects to the web application, the back link will end up on the attacker's site, which can present a phishing page.

So the user may trust that all links within the application are trustworthy, while a link actually may end up on another site. An actual phishing attack would be hard, since the victim first needs to visit the attacker's site, be convinced they are visiting the trusted web application, and click the back button without noticing they are leaving the trusted application.

|improve this answer|||||
  • Interesting thought. I guess a valid scenario would be something like help pages with a 'go back' link at the bottom or something. The attacker could safely link to those pages because the user will just return to the attacker's site. If the user happens to check the domain while on the help page, everything will check out. But these pages are rare (especially with more modern web design) and the risk does seem very very low. – Luc Feb 26 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.