I created a slideshow and mentioned that user must not trust URL based on file extension, however, I got some claims against that, because URL's like this should be safe:

  • example.com/images/pic001.jpg
  • example.com/files/cv.pdf
  • example.com/media/track2.mp3

As I knew using Apache Mod Rewrite attacker can redirect any URL with any extension to executable file by direct download, at that case, only Antivirus can protect user when clicked on any link, so,

What are risks of URL's generally?

How to check if the URL not a link to malware before download?

3 Answers 3


Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff.

More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one:

Content-Disposition: filename="myfile.exe"


I don't think you can really trust any URL just by looking at it (taking URLs in general).

You could use a service like Virus Total to scan it


That is still not fool proof though.

  • 1
    Please be aware that VirusTotal is now owned by Google. Just sayin'... (insert twisted evil grin here) Jul 21, 2013 at 8:26
  • I guess we should create a new start up!
    – Casey
    Jul 21, 2013 at 15:05
  1. Reputation - Obviously you can put a little more trust into big names like facebook.com or google.com when compared to clickhereforfreeporn.com. Reputation isn't foolproof though, sites can be hacked. However, reputable sites should (hopefully) put a little more effort into securing their stuff so I won't worry about it too much. If I do get a malware, I'll just let my AV deal with it or wipe my machine in the worst case scenario.

  2. Scan it with VirusTotal before clicking the URL. Obviously this is a pain in the ass and it is not something you can expect users to do before clicking on every single link in front of them. It's also not foolproof as VirusTotal cannot not detect every single piece of malware out there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .