Questions tagged [url]
The url tag has no usage guidance.
157
questions
0
votes
0answers
31 views
Injecting script from outside for local machine url request
I have setup a local apache server with php module.I deployed a dvwa in my localmachinne..I am learning about XSS(DOM) type of attack.I setup the low level security in dvwa.When i added <script>...
2
votes
2answers
106 views
SQL injection using URL query string (web application/php server)
Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.
Using URL site. example:
www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...
1
vote
0answers
17 views
Passing 3rd Party Access Token in redirection URL of 3rd Party Website
I am integrating a website with 3rd party API. The 3rd party site allows me to generate Access Token by using Client Key/Client Secret.
In one of the pages, I need to redirect to 3rd party site 's ...
0
votes
0answers
36 views
Is using “Signature Versioning” in Amazon S3 a secure way of selling ebooks?
I own an ecommerce platform that sells large (500 megabyte+) ebooks. To reduce server costs I am looking at hosting the ebooks on S3 and using Sendowl/ FetchApp to create the links to the downloads.
...
-2
votes
3answers
134 views
Can a URL contain executable JavaScript?
I am learning about "Session fixation" and have read the corresponding OWASP page.
In their Example 2 in the above page, they describe an attack via JavaScript, that is embedded in the URL like:
...
0
votes
2answers
64 views
one-time link on 1ty.me
1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is ...
0
votes
1answer
97 views
Phishing urls from shnpoc.net/McAfee?
I was looking into my websites traffic and found few entries from a subdomain for shnpoc.net domain. And when I looked into it, it was transparent proxying my website.
On checking further, I found ...
1
vote
0answers
78 views
Blocking URL brute-forcing on my server
Every day my server receives many GET requests in search of security holes. In other words, they are trying a list of words in search of a hole.
for example:
http://myapp.com/phpmyadmin
http://...
1
vote
1answer
104 views
Why modern php web application requires to specify the application's url?
Pieces of web applications such as WordPress or moodle require to specify the URL that the user will provide in order to visit the site. For example, in moodle has the $CFG->wwwroot config ...
0
votes
0answers
43 views
Trace the orgins of a DNS request [duplicate]
I installed a DNS server on a Raspberry PI to monitor DNS requests. One request that is curious is "fscta65w.com." It keeps showing up in the querlog from a macbookPro but I can't seem to find out the ...
1
vote
1answer
63 views
How to protect against injection into a 3rd party REST API?
I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters.
E.g. /data?startDate=2019-01-01 or /data?name='John Doe'
It is easy to form ...
0
votes
1answer
98 views
What type of vulnerabilty is this?
I'm testing a website:
https://this-site.com/path/to/dirs
but what i've found is if I do the following below the site will load 4 pages in a infinite loop
https://this-site.com/path/to/dirs/.../.
...
3
votes
0answers
39 views
What does IIS query string validation protect from?
Recently we had a failure in one of our systems because IIS rejects query strings with (URL encoded) parameter values containing the sequence &#. It doesn't reject & #.
We've got tired of ...
2
votes
1answer
203 views
Replace PATH space with random string
I came across
http://test.co.uk/img/rOTJwSOqWzHaDsEUcHhI.
If we take a look at it the directory space is protected against bruteforcing of the whole directory to explore private images.
I don't know ...
4
votes
1answer
106 views
What's the security risk of using a protocol-relative URL in a CSS stylesheet?
I used SonarQube to perform a static code analysis of my project and it detected a security vulnerability in one of my CSS files:
For security reasons, protocol-relative URLs should not be used.
...
1
vote
1answer
246 views
Hacker101 Spoilter #2 EASY Micro-CMS v1
I am just getting into CTF and Hacking in general. I am very confused as to why this worked when I added an apostrophe to the end it reveals the flag. I have Burp Community Edition suite going and I ...
1
vote
1answer
182 views
What is this URL that loads each time Google Chrome spawns?
What does this URL do that opens each time Google Chrome loads?
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0....
1
vote
3answers
105 views
Is exposing enumerated id's a bad idea if precautions are taken?
Say I have a website that has the URL website.com/student/{studentId}/courses for retrieving all the courses a student is enrolled in. The studentId is an auto-incrementing value in the Student table ...
0
votes
1answer
64 views
Exposing a version number through the assets urls
I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/...
0
votes
3answers
207 views
Can phishing site URL shorten into numbers?
A suspected hacker was trying to get the user to input those numbers (2412958) in their address book. And user knows that the numbers are weird.
Can URLs be shortened in texts like that?
0
votes
0answers
43 views
Url Storage, History & Personal Data
Just Curious to Know,
Where my information is being stored and how long its kept for
I'm running the latest version of windows 10,
my main Browser being firefox developer edition 68.
I clear my ...
0
votes
1answer
85 views
Viewing URLs on Mobile Devices
What are you doing to help your users view URLs in emails on mobile devices? Our training program is helping people to understand how to view URLs before clicking the actual link. On mobile devices ...
1
vote
2answers
238 views
S3 Bucket Name Obscurity as Security
Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. *
Can I assume that a public S3 ...
0
votes
1answer
70 views
Encrypting PHI query params
In a bunch of APIs, there are several possible query parameters. Some of these may be PHI. So even if we are using HTTPS, they could go to a logfile or somewhere else and hence violate PHI.
Was ...
0
votes
1answer
430 views
Is there any security advantage to hiding URL parameters?
I am building a web app that needs to be secure. Is there any security advantage to hiding path parameters? I am using Angular (I don't know if this is important).
What I mean by hiding path ...
1
vote
1answer
360 views
URL query string params Django security
I am new to Django and I am working on a website, where you can filter some articles using a normal GET url query string param. Theese params can be made from some input fields. I have found two ...
2
votes
1answer
147 views
Is it a good rule of thumb to keep a URL as short as possible?
I was wondering if there are any security risks of having too long URLs for an internet site.
Of course there are things that don't matter if they're long or not, i.e. the actual hostname and ...
0
votes
1answer
218 views
How do I investigate a suspicious link?
I made a RuneScape account about a week ago. I stupidly responded to a scam by clicking on a link provided to me in the game. I think I may have a keylogger, which would explain why my new account was ...
-2
votes
1answer
95 views
is it possible that an attacker catch a page name from history?
like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
0
votes
1answer
128 views
Semantic URL Attack Mitigation
I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks
Example
updateprofile.php?uid=1
I can change to
updateprofile.php?uid=2
I can update the second user'...
0
votes
1answer
108 views
Bypassing URL verification [closed]
I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods).
Here is a slightly modified version of the function:
public static bool IsValidURL(...
0
votes
0answers
16 views
Whats this Encryption? [duplicate]
Anybody know whats this encryption ??
H4sIAAAAAAAAAH1Ry27bMBAE2qaA/oEFeE tkNQjdoEeKJt29LQqyU7TG2MxskyFMSTLdvL1pZUei/Cys5yZ3QH2E43SIBx53vHOP03Gtk0m9bbaGF6z30llTPOwwMYMGQwZc ...
0
votes
1answer
126 views
Is session id in url itself for all the requests an issue? [closed]
Is session id in url itself for all the requests an issue?
0
votes
0answers
27 views
Requests to /android-app://com.twitter.android/twitter/user - what is the intention?
I wonder what requests to https://ourdomain.com/android-app://com.twitter.android/twitter/user are doing - is that a kind of attempt exploit a vulnerability?
I encounter them in our web server logs ...
0
votes
1answer
147 views
I was redirected to an infected site, what should I do?
I always avoid suspicious links, but recently, in one of my google searches, I clicked the first link on google (looked just a normal site), but it immediately redirected me to a weird news site (the ...
0
votes
0answers
38 views
Is there a positive consensus on the security of URI-based launch schemes?
Consider the following situation: I am developing a website, and a native Windows/Mac executable to go along with it. The executable registers itself under a URI scheme so that it can be launched from ...
1
vote
1answer
171 views
Weird Google Redirect Bug?
So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
-2
votes
1answer
91 views
how to decode this request [closed]
I need help for this. I got a request but I don't know what can I do:
GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1
Full request : https:...
0
votes
1answer
103 views
Is this redirect on my website dangerous?
I have this URL that I sometimes use to redirect my users. It looks like:
https://mywebsite.com/?redirectTo=
However, I'm checking if the domain part of the parameter ends with:
google.com
...
1
vote
0answers
65 views
How to determine if a website has been hijacked?
I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL.
I was surprised by this change, ...
0
votes
1answer
299 views
Triaging malicious URLs
I'm quite new to the security field and learning my ways on how to triage certain events.
One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if ...
2
votes
3answers
411 views
Malware Analysis
What would be a good approach for testing malware or bad url's from things picked up from my SIEM to validate them? I was told to setup a VM for these tests but don't want it to hit the internal ...
-3
votes
1answer
154 views
How long would it take to brute force a URL path that's 5 characters long
example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
85
votes
8answers
15k views
What attacks are made possible by public release of my web history?
Assume that my Internet history is made public (accidentally or on purpose). And this release is over 24 hours since the visits were made.
Also, assume that there aren't embarrassing sites on there: ...
2
votes
1answer
158 views
Malicious Google Drive Links
Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
3
votes
2answers
128 views
Can a URL that has no links to it be discovered? [duplicate]
Say there is a URL example.com/abunchofrandomsymbols and there are no links to it anywhere on the internet. Could it be discovered somehow?
My guess is a browser like Google Chrome could report it to ...
1
vote
1answer
165 views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
2
votes
2answers
212 views
How can AWS API Gateway be used to rapidly rotate credentials in this fashion?
Reading through this article, I hit a little wall of understanding. The author states:
This is because my laptop doesn’t have the secret weapon. Once you get
this up and running on an EC2 ...
0
votes
1answer
176 views
Unknown URL parameters in google query
I received an email which is classified as "potentially malicious" by my email program (Thunderbird), where links are actually a google URL query with extra parameters:
For example, the displayed ...
1
vote
1answer
812 views
I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?
A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability ...
