Questions tagged [url]
The url tag has no usage guidance.
213
questions
0
votes
2answers
58 views
How big must the random string be and how long should a user activation link be available?
As I see in this answer that cryptographically secure randomness is a must in user activation urls such as:
https://example.com/user-activate/^random_string^
But what are considered best practice ...
0
votes
1answer
85 views
Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?
Usually once you register in a website you need to visit a url like:
https://example.com/user_activate/^random_string^
Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
0
votes
0answers
47 views
What ways a website could hack a device? [duplicate]
Is it possible that clicking a link would hack a device?
For example:
injecting a malicious code into the device directly from the link's host website
connecting to the device remotely in a way ...
0
votes
1answer
84 views
Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?
I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
1
vote
1answer
60 views
How are validation links getting triggered by a third party?
Question: It appears that somebody can intercept and read emails that I send from my server, although
I have set up 2-Factor authentification for sudo-access
I log all logins on my server (Did not ...
1
vote
4answers
262 views
Why don't bigger companies buy similar domains to their main domain to prevent typosquatting?
One big threat out there is typosquat domains. For example instead of:
steamcommunity.com some malicious actor will register the domain stearncornmunity.com and set up his fake steam login.
Why do ...
0
votes
0answers
318 views
crl.comodoca.com is a legit crl site, how can I determine it's legitimacy when bad actors are attempting to abuse uncertainty about the site
Yesterday I noted in my router logs that my wife's laptop accessed crl.comodoca.com. She was not using the machine at the time. A quick google search found three sites claiming this was an ...
0
votes
0answers
60 views
Accidentally clicked on a malicious URL that on later research lead to a dead URL. Could it have done anything/were my precautions good?
First time question after lurking every so often. This issue has me a little riled, and would love to know more on how I did/if it did anything, as well as peace of mind on the subject.
Today/morning, ...
101
votes
4answers
11k views
Can I safely preview a short link?
There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also:
obfuscate the actual URL
collect statistics about the usage ...
0
votes
1answer
160 views
Can someone know my browser and headset model via browsing a link?
I recently clicked on a malicious link on Reddit When I was directed to the link, it asked me to do a couple of captchas. I did them and then was redirected back to Reddit. Then he said he could see ...
0
votes
0answers
85 views
Is UUID enough to secure public links? [duplicate]
I send email invitations to people and each invitee gets a unique link where they can click on a button to leave a response. The data is not very secret, the worst thing that can happen is that ...
-1
votes
2answers
196 views
Are the private URLs from Google Photos actually unguessable?
Maybe my math is wrong, but here it goes.
If I generate a private url to share an album in Google Photos, I get something like this
https://photos.app.goo.gl/*****************
where the asterisks are ...
0
votes
0answers
78 views
Were Google's old link-sharing links not cryptographically random?
This year, Google is notifying users that shared links to their shared Google drive files will change:
https://support.google.com/a/answer/10685032?hl=en
The announcement begins:
To make file sharing ...
0
votes
1answer
82 views
Algorithm to find 'owner' of an arbitrary (scammer) URL?
I'm getting a lot of scams on my mobile phone, and have just tried explaining to my wife how to find out who the 'owner' (network host name?) of a URL is before clicking on it. The basics are obvious -...
0
votes
2answers
239 views
Why are there so many special characters in this phishing link?
I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd:
The link that victims are supposed to click looks very weird ...
24
votes
3answers
4k views
Browser is accepting italic/bold Unicode as part of SPAM email's URL
This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
0
votes
0answers
73 views
Can hashbang (#!) URLs be used to SEO attack a website?
Apparently Google indexes hashbang URLs: https://www.youtube.com/watch?v=kDs-MufuiAg
Can an attacker link to another website with fictitious hashbang-URLs and use it to hurt that website (if the ...
0
votes
2answers
100 views
Keyed Hash Function (HMAC) For Unguessable URLs?
I have numeric IDs that I would like to use in filenames. So for example with IDs 1, 2, 3 we would have 1.jpg, 2.jpg, and 3.jpg
Now the problem is that clearly a user could just guess 4.jpg and view ...
2
votes
2answers
222 views
Can a JWT be all lowercase?
I'm using JWTs as part of an URL in order to direct a user to a specific site. I could have just used a UUID, but it's nice to have an expiry date in the link, as well as knowing whom the link is ...
1
vote
1answer
119 views
Some random string is appended prefixed by a DOT at the end of URL
Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows.
The request URL which our ...
7
votes
1answer
228 views
Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
0
votes
0answers
77 views
Additional verification, sanitization for transcoded CJK paths in URLs
Suppose there is a file hosting server, and most filenames are strings with mostly CJK characters. Transmitting those characters in HTTP GET requests requires encoding them using UTF-8 (x3 overhead) ...
1
vote
0answers
82 views
How following URL's will get open-redirection?
Reading about open-redirection from web application hackers handbook came across a test case in which the server-side is validating user supplied data that the application uses to set target for ...
0
votes
1answer
89 views
Link test differs from link location in plaintext view is not visible in Thunderbird
Today I noticed something strange.
I got an email containing a link that links to another site than the text says. In (Simple) HTML, the review is visible when hovering over the link.
However, in ...
0
votes
0answers
117 views
How to intercept application specific MIME types used by 3rd party (Windows) browser/plugins apps?
I'm trying to intercept and decipher scripted code that is sent to a previously installed Windows application, after a user have clicked on a particular URL in their web browser which is somehow ...
3
votes
1answer
136 views
How to create custom exploit https requests to test a PHP framework [closed]
I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
1
vote
1answer
113 views
What are the risks associate with accessing Same web application with two different URLs?
We have done vulnerability analysis with third party security team. They have mentioned one point as critical findings but i don't understand risk associated with it and suggested remedial action also ...
0
votes
0answers
18 views
Security implications of protecting private data with a long URI exclusively [duplicate]
A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this?
I can think of ...
27
votes
4answers
8k views
Could receiving a URL link, not clicking on it, ever pose a security problem?
Could receiving in a text or an email, a URL link just like https://security.stackexchange.com/questions/ask of a website, which could be a pernicious one, ever pose a security problem at all? What I ...
22
votes
3answers
6k views
Can ISPs selectively block a page URL on a HTTPS website leaving its other page URLs alone?
I want certain web pages blocked (within my country) by my Govt on a website that uses HTTPS on all pages. My Govt agrees that the specific URLs need to be blocked but expresses helplessness as their ...
0
votes
1answer
96 views
Does forwarding a link expose my IP address? [closed]
So my friend sent me a IP grabbing link. I copied and pasted into playstation messages and sent it to my cousin. I’m wondering if my friend got my IP because I copied and pasted. I didn’t open the ...
0
votes
1answer
139 views
Can just clicking on a malicious link lead to hacking of my device? [duplicate]
I was not sure about it and I got some answers from internet but didn't get the logical reasoning behind it.
If I just click on a malicious link it might open a new tab, or it might download something....
0
votes
2answers
231 views
Is it standard practice to hide where links point in a legitimate email?
Someone in our family recently requested a password change for a website (Costco). Soon after requesting, they received an email with the standard "click the link below to reset", followed ...
0
votes
1answer
104 views
Is a QR code with a secret URL that changes every 5th minute secure?
I need to verify that survey respondents are in the same physical room or video chat (to prevent industry espionage). The respondents can join by scanning a QR-code that opens a URL which embeds a ...
1
vote
0answers
72 views
Best practices for handling links in discussion posts
Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and ...
-2
votes
1answer
161 views
Can someone tell me whats the encryption in this? [closed]
khgpd://zpn.xddspbx.nrf/j/9djwth14tmct9tf/uzdwvrrnonv.tue?gz=0
This is an encrypted text and is most prob a url....pls decode it or tell me which cipher is it, this is not for any security breaches ...
1
vote
2answers
1k views
How to not use database identifiers in a URL in the context of a REST API
During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
22
votes
3answers
6k views
What's a "safe" URL shortening algorithm?
The situation: Currently, we are sending out emails and SMS to our users, which include a link to a form that each user has to fill out on a regular basis (an "eDiary"). As we need to be ...
1
vote
1answer
263 views
Is this "secure email" mechanism my bank wants me to use best practice?
So, yesterday I needed to sign & scan some forms for my bank, a credit union. Nothing hugely confidential, except it has some account numbers on it. But still, I was a bit concerned, so the ...
0
votes
1answer
92 views
token _csrf in an url POST
I wanted to know if it was a bad thing to have a _csrf token stored in a url. I saw that in a POST request that allows me to upload a file, the _csrf token was displayed in the url. Is it sensitive to ...
0
votes
1answer
491 views
How to secure my PHP url endpoints
I have a backend that I developed on PHP/MySql which will provide some URL endpoints in order to get data or post data. I am using those URL endpoints in my application (WebGL application). Now, the ...
1
vote
2answers
99 views
How some sites prevent cross-site requests through referrer although there are redirections allowed
I read about referrer header that some sites use to allow only requests made by the pages of the site. So if I make a page hacker.com, and let this page make a request to https://twitter.com/i/flow/...
0
votes
0answers
155 views
Random URLs to hide assets [duplicate]
Say I own a domain name www.example.com and I'd like to host some resources on it, but being reasonably hidden from the public.
Since a 256 bits has a sufficiently large entropy to prevent an ...
1
vote
1answer
178 views
How short can a shortened base 62 url path be and be reasonably protected from a brute force attack?
If one is creating pseudo-random base 62 url paths, and one didn't want those paths to be reasonably vulnerable to brute force attack. How short could they be?
Reasoning
Now one could have expiring ...
1
vote
1answer
140 views
Is this url verification with startsWith secure?
I would like to know if this code is secure to validate that a url is from my domain before loading it a webview in android :
if (!url.startsWith("https://www.example.com/test/")){
// don't load ...
1
vote
0answers
295 views
How to unencode email urls rewritten by Black Spider [closed]
Since a few months, many organisations have urls in incoming mail rewritten to be redirected through a checking service (Outlook Safelinks, Proofoint, FireEye, Black Spider/Forcepoint). Because this ...
1
vote
0answers
163 views
What type of attack is this? '[0]
This is the example query: GET directory/file.txt?lang=it'[0] HTTP/1.1
I don't know what language it is. The ' (single quote) reminds me of a SQL Injection.
I don't think it's a typo because I saw ...
62
votes
3answers
6k views
Security risks of fetching user-supplied URLs
We are considering to add the following feature to our web application (an online product database, if it matters):
Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
0
votes
1answer
72 views
HTTP/HTTPS/GET/POST : in which cases can a malicious router between client and server find a secret information? [duplicate]
Let's say I connect a safe server example.com.
In which case(s) can a malicious router in the middle of the route (or my ISP) see secret?
1) HTTP + GET, secret in URL query parameter : http://...
1
vote
5answers
558 views
Username in browser history (url) - is this a security problem?
We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
