Everyone says not to click on "malicious URLs". Are there any attacks where the URL itself, rather than the resource accessed by the URL, is the attack vector?

  • Yep! (The same thing happened more recently with the custom protocol handler dialog in Safari on Mac OS X, but I haven’t been able to find it.) – Ry- Oct 31 '14 at 19:44

Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector.

Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.

| improve this answer | |
  • just read the paper; first impression: "will this ever end?" – that guy from over there Oct 31 '14 at 8:08
  • 1
    Is RFD attacks still reproducible on OSX Chome? I just tried and can't get it to work. – MD6380 Dec 7 '16 at 2:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.