Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [url-redirection]

URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

1
vote
1answer
57 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
3
votes
2answers
152 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
3
votes
3answers
141 views

Clicking on a Google search result sometimes redirects to malicious site

Key Facts: On 3 separate occasions, in the past 3 months, with 3 different google search queries, I was redirected from the intended site to a malicious site. Always from a Google search using ...
2
votes
2answers
109 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
105 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
1
vote
0answers
64 views

I clicked on an imgur link in an SE chat room and ended up at a url in India with a screen that looked like Google; what happened?

In a message in Space Exploration chat https://chat.stackexchange.com/transcript/message/46420646#46420646 there was a link to imgur.com which I naively assumed would be an image, GIF, or perhaps ...
1
vote
1answer
186 views

I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?

A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability ...
1
vote
3answers
211 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
-1
votes
1answer
421 views

301 Moved Permanently on nginx server

If I request this: http://mysite.com/\/\http://evilzone.org Response: HTTP/1.1 301 Moved Permanently Location: https://mysite.com/\/\http://evilzone.org Is it a vulnerability?
74
votes
4answers
10k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
1
vote
1answer
107 views

Any browsers where I could escape the URL with certain characters?

On this website, you can specify your YouTube channel URL and it makes a button on the profile page that will go to that URL. This text entry has no restrictions other than that it has to be less than ...
0
votes
1answer
130 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
0
votes
1answer
171 views

“Go” subdomains with empty redirect url?

I've tested a lot of websites, and I've found that many sites have a "go.example.com" subdomain that returns the following error message: 404 Not Found The redirect url is empty This message makes ...
1
vote
2answers
292 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
2
votes
1answer
168 views

Suspicious redirect in Chrome

I was online and one of the sites randomly redirected to a site called mcafeesecurity.application-center.club. It was talking about how my mcafee has expired (my subscription is current). I scanned ...
-1
votes
1answer
140 views

Malicious URL - just Chrome [duplicate]

I was scanning a file on VirusTotal.com and it was identified malicious by only one antivirus (1/68 antiviruses) called CMC so I was interested to know about this antivirus, see if it's the deal or ...
2
votes
1answer
87 views

Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other. As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
276 views

URI redirect with only query parameters

Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters? In pseudo-code, creation of the URI looks like this: URI = "/example/path?" + "...
1
vote
1answer
411 views

How to bypass response Location in order to obtain content XSS?

In some basic steps: POST Request containing a photo with multipart/form-data. HTTP/1.1 302 Found respond with redirect back to formular Redirect to initial formular. In case 1 we are able to ...
0
votes
0answers
45 views

What is going on with these requests? HEAD with encoded backslash, and my site embedded in the url

I found these entries in my access log, and I found them rather weird. As I don't know what HEAD's purpose is here or what their intent was with this. I have the first couple as an example, but it's ...
5
votes
4answers
2k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
1
vote
1answer
672 views

URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

I was browsing for help on how to connect a PS2 controller to my pc. I found what I was looking for here: https://gaming.stackexchange.com/questions/262873/do-playstation-2-controllers-support-usb-...
10
votes
5answers
4k views

How safe is redirecting to another site?

Lets say I have a website at https://example.com/test. Whenever someone accesses this site, I want to just simply redirect them to https://example.com/Test. Are there any possible vulnerabilities ...
6
votes
3answers
273 views

What security holes are introduced by clicking an unknown link?

I recieved an email today that told me that "My account was comprised", an obvious fishing attempt, or so I thought. When I clicked the link, just for the fun of it, it brought me to a page which ...
0
votes
1answer
56 views

Redirection using HTTP meta tag

I've created a small project, where I scan a 1000+ sites for TLS implementation, including Does a https site exist Does the site redirect from http to https Various other info about the cert ...
1
vote
1answer
72 views

Phishing: allow # in user provided redirect URL?

I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned ...
0
votes
1answer
65 views

Avoiding redirects

I'm working on a site where users can input URLs. The URLs should point to sites where you can buy an item (for birthday/special event/...) It also sends out mails to e-mail addresses the user ...
27
votes
4answers
5k views

Why do compromised web sites often take you through multiple URL redirections?

Quoted form my course instructor's lecture: The following are the stages of a typical web attack: The victim visits a legitimate web site that has been compromised. The compromised web site ...
2
votes
2answers
293 views

Limiting redirect parameter to specific domain

Using PHP to set a Location header to redirect (e.g., upon login after being signed out) can be insecure if the redirect does not specify a domain. Here is an example: header('Location: ' . $_GET['...
31
votes
3answers
4k views

Should domains which only make redirects (aka tiny urls) be encrypted (https)?

For this question I will use the following domains: example.com - an online shop exmpl.com - a domain which is used for sharing items. exmpl.com will be used for redirects (e.g. http://exmpl.com/foo ...
-4
votes
1answer
968 views

How do I prevent the URL open redirect vulnerability? [duplicate]

I have created a vulnerable Code for Open redirect vulnerability, but now I want to secure it. But unfortunately, I didn't find on google so decide to come here., So, this is my html file code, in ...
4
votes
2answers
171 views

Is there any way to protect ourselves from annoying redirects?

It is not the first time I have been redirected to a malicious site. I was trying to download a song from a website when I clicked on download and was immediately redirected to a page which says "Your ...
3
votes
1answer
90 views

Why are downloads of Mac updates redirected to plain HTTP? [duplicate]

I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here. Funny thing is, when I right click and get the download link from ...
0
votes
1answer
122 views

Blackbox URL matching mechanism bypass for an open redirect

I'm currently testing a web application, which appears to have an open redirect vulnerability, since they receive a parameter redirect_url via GET. The application redirects the user to this URL later ...
4
votes
4answers
945 views

Redirect malware in BIOS or MBR can't remove it

I bought a brand new Dell Inspiron 15 7567 laptop factory sealed and new. I booted it up went through the install process and finally logged in. Opened the edge browser and went to Youtube to play ...
3
votes
1answer
64 views

Redirected to unsafe page on freshly installed Windows 10

This is my first question in security, so let me know if something about the question should be fixed. Some background information: My Windows 10 laptop was starting to get realy, realy slow when ...
3
votes
3answers
2k views

Is it unsafe to redirect to the referer URL?

Is it a problem when URLs in a web application redirect to the URL specified in the Referer header? It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be ...
3
votes
2answers
360 views

How can ISP's block a website specific content while using encrypted connection?

I'm learning about encryption and SSL certificates and I'm wondering: If an encrypted connection is used when connecting to a website using a SSL certificate, how can ISP/company manager/government (...
22
votes
3answers
10k views

Does HTTP redirect to HTTPS automatically?

When we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing? Am I right? If wrong, ...
0
votes
2answers
832 views

Trying to examine URL redirection in Wireshark

I clicked on a link (indistannews.com) and was redirected to a different website (sexiniowa.com). [Warning - the latter site is a pornography website]. I looked at the transaction in Wireshark to try ...
1
vote
2answers
260 views

Validate if URL (message) is coming from a trusted source

We are working on a redirecting page for our mobile apps. Users would go to a page like: https://mobileredirect.our-app.com?target=https://clientdomain.com/some_resource Mobile apps on iOS and ...
-1
votes
1answer
376 views

Open redirection URL

So i have been studying a lot of bug report regarding redirecting URL to a malicious website,most are understandable like when you log in or log out or you are just being redirected to another domain ...
0
votes
0answers
36 views

google crawled link shows different content

Recently I had a SEO spam hack on my website and when I search in Google it was showing malware content in the description. But one strange thing is link. If I access the domain via browser it shows ...
277
votes
3answers
21k views

How did “tech-supportcenter” phishers trick Google?

Related: Is the Web browser status bar always trustable? How can Google search change the location in a URL tooltip? I've always thought you can "hover" over a link to see where it really goes, ...
0
votes
2answers
266 views

Is there any way to force browse HTTP if all the traffic is redirected to HTTPS? [closed]

The webserver is configured to redirect all HTTP request traffic to HTTPS. And there seems to be different application running on 80 and 443. 443 is not vulnerable but there are lot of vulnerability ...
4
votes
1answer
2k views

Colons in URLs: Safe?

A friend asked me if it is relatively safe to click on the following link: https://disq.us/url?url=https%3A%2F%2Farstechnica.co.uk%2Finformation-technology%2F2017%2F01%2Fantivirus-is-bad%2F%3Av0Er-...
1
vote
1answer
63 views

Is it possible or common for a website (without ads) to only sometimes do a malicious redirect?

Using Chrome, I went to a website of a company we were researching, following a link from a google search, and got redirected to a malicious website. After killing Chrome and scanning for viruses, I ...
2
votes
0answers
99 views

How exactly do malicious ads run code?

Visiting quite a few malwaretisers (I think this is the term :) ), I get popups with address bar something like data:text/html;base64,PGh0bWw+PGJvZHk+...
0
votes
3answers
234 views

Page redirecting to “malicious” content

Recently I was visiting a web site that was is hosted in China (I can tell by the IP, it's assigned to an University over there). When I accessed their page today, it loaded but after the initial ...
1
vote
1answer
429 views

Malicious PHP script redirecting crawler traffic [closed]

Our website seems to have been recently compromised. The attacker had modified .htaccess to reroute traffic from search engine crawlers to a php script. The php script was encoded with Base64, then ...