Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [url]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
41 views

Under which situations is open redirection possible?

I am searching about the open redirection attack. When I look at websites that try to explain the situation, they generally say to test the URLs in the form of www.example.com?redirection=... to see ...
Not a Salmon Fish's user avatar
21 votes
6 answers
11k views

Are Cyrillic characters a real threat?

I've seen people in security saying URLs with Cyrillic characters are dangerous. If you ever type such characters on a browser you'd see they break into crazy unrecognizable URLs that have nothing to ...
Gatonito's user avatar
  • 363
1 vote
0 answers
109 views

I clicked on a suspect link, whose base url was live (dot) tvstreaming4k (dot) com, during a live event. Is this a threat? [duplicate]

Edit: It has been observed that my question may already have an answer here How to check whether a link is safe or not? [closed] and here How do I safely inspect a potentially malicious website?. Even ...
Ender Wiggins's user avatar
2 votes
2 answers
2k views

Steps after accidentally opening malicious URL with Android device

So I opened a malicious URL with my Android phone. It took some 20 seconds to dawn on me after which I put it on airplane mode. I didn't enter any info in the meanwhile. I tried to see if I can assess ...
Manouil's user avatar
  • 23
0 votes
1 answer
122 views

URL redirects properly to all URL protocols except https://www

I have a domain that properly redirects as expected to protocol https://newhavendisplay.com, except for https://www.newhavendisplay.com, which triggers the "This connection is not private" ...
Nick's user avatar
  • 3
1 vote
2 answers
264 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
vertigo's user avatar
  • 13
1 vote
1 answer
308 views

Azure Shared Access Signature (SAS) token security

I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible. When I generate a connection string there is a SAS token embedded in the URL. That token has ...
Ozwel's user avatar
  • 173
0 votes
0 answers
126 views

Auto-login to account with PII using a random URL

I have a booking system where passengers need to add information that is quite sensitive (passport details etc). When they book, I generate a (difficult to crack) reference number, which they use to ...
Sprep's user avatar
  • 101
0 votes
1 answer
87 views

Clicking on links [duplicate]

We are often warned about clicking on links in emails from unknown senders. That got me to wondering about other situations. For instance, you are searching the web looking to purchase an item and ...
Not_Einstein's user avatar
0 votes
1 answer
165 views

Sharing a text file via Amazon S3 link with random words numbers [duplicate]

I would like to share a csv file to two or more separate computers/users. They would be running our software program which reads this text file. This is just initial idea for feedback please. To make ...
Matthew's user avatar
  • 101
-1 votes
1 answer
3k views

can my ISP know which urls i'm visiting? If so then how to prevent it? [duplicate]

i'm using latest version of microsoft edge browser on windows 10 PC and i'm in India. I use cloudeflare DNS. i Checked my browser security on https://www.cloudflare.com/ssl/encrypted-sni/ and got this ...
Ezio's user avatar
  • 35
0 votes
1 answer
147 views

Where could I find a list of keys not to use for DES encrypting

We have a process that encrypts a URL, it uses DES encryption. I suspect someone may have figured out the key and is decrypting it to crawl information. This was set up many years ago, I just want to ...
Sanpopo's user avatar
  • 119
0 votes
2 answers
592 views

Parameter vulnerable for HTML injection but cannot exploit because of URL encoding

I found a HTML injection vulnerability but there is an issue. The following request returns the following: curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<...
Ugroon's user avatar
  • 11
32 votes
5 answers
7k views

Is there any security benefit from emailing a "secure link"?

Sometimes I receive email messages from organisations I'm involved with saying something like: Alice at AnyCo has sent you a secure message Along with a link to access said message. Sometimes I'm ...
James Bradbury's user avatar
0 votes
2 answers
209 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
codiMonster's user avatar
1 vote
1 answer
564 views

What is a safe way to display malicious URLs in research PDFs?

Is there a convention or safeguard to show malicious URLs in a paper if they are relevant to the topic? Some PDF viewers parse the text for URLs, which makes removing the hyperlink alone insufficient. ...
rollcoaster's user avatar
0 votes
1 answer
250 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
Tallboy's user avatar
  • 105
0 votes
1 answer
77 views

Multiple random requests for Non-Existent URLs from a single IP resulting in 404s

We sometimes get to see this behavior from a single IP address/logged in user - There are a lot of hits on our server that have .png at the end of the URL which results in a 404 because we don't have ...
Pranav's user avatar
  • 1
0 votes
1 answer
1k views

Making a phishing link look innocent

Situation I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading ...
Caeleste's user avatar
  • 103
-1 votes
1 answer
170 views

Automated malicious links delivered with e-mail (Reddit, LinkedIn, Package) [closed]

Recently my organisation has been flooded with phishing e-mails with different approaches: pretending to be Reddit or LinkedIn information about a new follower or package delivery status/problems, etc....
deevee's user avatar
  • 383
1 vote
1 answer
186 views

Suspicious hyperlinks (all hex URLs) in e-mail

I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...
Daniel Walker's user avatar
0 votes
2 answers
453 views

How big must the random string be and how long should a user activation link be available?

As I see in this answer that cryptographically secure randomness is a must in user activation urls such as: https://example.com/user-activate/^random_string^ But what are considered best practice ...
Dimitrios Desyllas's user avatar
0 votes
1 answer
162 views

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
Dimitrios Desyllas's user avatar
0 votes
0 answers
132 views

What ways a website could hack a device? [duplicate]

Is it possible that clicking a link would hack a device? For example: injecting a malicious code into the device directly from the link's host website connecting to the device remotely in a way ...
Ramad530's user avatar
0 votes
1 answer
191 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
Jsbko's user avatar
  • 1
1 vote
1 answer
114 views

How are validation links getting triggered by a third party?

Question: It appears that somebody can intercept and read emails that I send from my server, although I have set up 2-Factor authentification for sudo-access I log all logins on my server (Did not ...
klopps's user avatar
  • 11
2 votes
4 answers
578 views

Why don't bigger companies buy similar domains to their main domain to prevent typosquatting?

One big threat out there is typosquat domains. For example instead of: steamcommunity.com some malicious actor will register the domain stearncornmunity.com and set up his fake steam login. Why do ...
birdd's user avatar
  • 41
0 votes
0 answers
3k views

crl.comodoca.com is a legit crl site, how can I determine it's legitimacy when bad actors are attempting to abuse uncertainty about the site

Yesterday I noted in my router logs that my wife's laptop accessed crl.comodoca.com. She was not using the machine at the time. A quick google search found three sites claiming this was an ...
A. Goldstein's user avatar
102 votes
5 answers
14k views

Can I safely preview a short link?

There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also: obfuscate the actual URL collect statistics about the usage ...
stackprotector's user avatar
0 votes
1 answer
212 views

Can someone know my browser and headset model via browsing a link?

I recently clicked on a malicious link on Reddit When I was directed to the link, it asked me to do a couple of captchas. I did them and then was redirected back to Reddit. Then he said he could see ...
BambooPrince's user avatar
-1 votes
2 answers
573 views

Are the private URLs from Google Photos actually unguessable?

Maybe my math is wrong, but here it goes. If I generate a private url to share an album in Google Photos, I get something like this https://photos.app.goo.gl/***************** where the asterisks are ...
cinico's user avatar
  • 103
0 votes
1 answer
128 views

Algorithm to find 'owner' of an arbitrary (scammer) URL?

I'm getting a lot of scams on my mobile phone, and have just tried explaining to my wife how to find out who the 'owner' (network host name?) of a URL is before clicking on it. The basics are obvious -...
QF0's user avatar
  • 101
0 votes
2 answers
458 views

Why are there so many special characters in this phishing link?

I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd: The link that victims are supposed to click looks very weird ...
user3684240's user avatar
24 votes
3 answers
4k views

Browser is accepting italic/bold Unicode as part of SPAM email's URL

This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
asker13's user avatar
  • 351
0 votes
2 answers
422 views

Keyed Hash Function (HMAC) For Unguessable URLs?

I have numeric IDs that I would like to use in filenames. So for example with IDs 1, 2, 3 we would have 1.jpg, 2.jpg, and 3.jpg Now the problem is that clearly a user could just guess 4.jpg and view ...
Zout's user avatar
  • 103
2 votes
2 answers
960 views

Can a JWT be all lowercase?

I'm using JWTs as part of an URL in order to direct a user to a specific site. I could have just used a UUID, but it's nice to have an expiry date in the link, as well as knowing whom the link is ...
Michael's user avatar
  • 177
1 vote
1 answer
383 views

Some random string is appended prefixed by a DOT at the end of URL

Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows. The request URL which our ...
ThilankaD's user avatar
  • 111
7 votes
1 answer
602 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
Mikko Rantalainen's user avatar
0 votes
0 answers
124 views

Additional verification, sanitization for transcoded CJK paths in URLs

Suppose there is a file hosting server, and most filenames are strings with mostly CJK characters. Transmitting those characters in HTTP GET requests requires encoding them using UTF-8 (x3 overhead) ...
DannyNiu's user avatar
  • 374
1 vote
0 answers
124 views

How following URL's will get open-redirection?

Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
Mohit's user avatar
  • 11
1 vote
1 answer
174 views

Link test differs from link location in plaintext view is not visible in Thunderbird

Today I noticed something strange. I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link. However, in ...
kaiya's user avatar
  • 452
0 votes
0 answers
250 views

How to intercept application specific MIME types used by 3rd party (Windows) browser/plugins apps?

I'm trying to intercept and decipher scripted code that is sent to a previously installed Windows application, after a user have clicked on a particular URL in their web browser which is somehow ...
not2qubit's user avatar
  • 275
3 votes
1 answer
232 views

How to create custom exploit https requests to test a PHP framework [closed]

I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
S. Imp's user avatar
  • 216
1 vote
1 answer
254 views

What are the risks associate with accessing Same web application with two different URLs?

We have done vulnerability analysis with third party security team. They have mentioned one point as critical findings but i don't understand risk associated with it and suggested remedial action also ...
Infra's user avatar
  • 655
0 votes
0 answers
19 views

Security implications of protecting private data with a long URI exclusively [duplicate]

A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this? I can think of ...
user9123's user avatar
  • 583
26 votes
4 answers
8k views

Could receiving a URL link, not clicking on it, ever pose a security problem?

Could receiving in a text or an email, a URL link just like https://security.stackexchange.com/questions/ask of a website, which could be a pernicious one, ever pose a security problem at all? What I ...
Hans's user avatar
  • 371
21 votes
3 answers
7k views

Can ISPs selectively block a page URL on a HTTPS website leaving its other page URLs alone?

I want certain web pages blocked (within my country) by my Govt on a website that uses HTTPS on all pages. My Govt agrees that the specific URLs need to be blocked but expresses helplessness as their ...
Desmond's user avatar
  • 327
0 votes
1 answer
648 views

Does forwarding a link expose my IP address? [closed]

So my friend sent me a IP grabbing link. I copied and pasted into playstation messages and sent it to my cousin. I’m wondering if my friend got my IP because I copied and pasted. I didn’t open the ...
Bob's user avatar
  • 1
1 vote
1 answer
3k views

Can just clicking on a malicious link lead to hacking of my device? [duplicate]

I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it. If I just click on a malicious link it might open a new tab, or it might download something....
Porcupine's user avatar
  • 111
0 votes
2 answers
392 views

Is it standard practice to hide where links point in a legitimate email?

Someone in our family recently requested a password change for a website (Costco). Soon after requesting, they received an email with the standard "click the link below to reset", followed ...
Carcigenicate's user avatar

1
2 3 4 5