Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

-1
votes
1answer
58 views

301 Moved Permanently on nginx server

If I request this: http://mysite.com/\/\http://evilzone.org Response: HTTP/1.1 301 Moved Permanently Location: https://mysite.com/\/\http://evilzone.org Is it a vulnerability?
73
votes
4answers
9k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
1
vote
1answer
105 views

Any browsers where I could escape the URL with certain characters?

On this website, you can specify your YouTube channel URL and it makes a button on the profile page that will go to that URL. This text entry has no restrictions other than that it has to be less than ...
0
votes
1answer
92 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
0
votes
1answer
81 views

“Go” subdomains with empty redirect url?

I've tested a lot of websites, and I've found that many sites have a "go.example.com" subdomain that returns the following error message: 404 Not Found The redirect url is empty This message makes ...
1
vote
2answers
137 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
2
votes
1answer
125 views

Suspicious redirect in Chrome

I was online and one of the sites randomly redirected to a site called mcafeesecurity.application-center.club. It was talking about how my mcafee has expired (my subscription is current). I scanned ...
-1
votes
1answer
112 views

Malicious URL - just Chrome [duplicate]

I was scanning a file on VirusTotal.com and it was identified malicious by only one antivirus (1/68 antiviruses) called CMC so I was interested to know about this antivirus, see if it's the deal or ...
2
votes
1answer
78 views

Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other. As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
45 views

URI redirect with only query parameters

Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters? In pseudo-code, creation of the URI looks like this: URI = "/example/path?" + "...
1
vote
1answer
136 views

How to bypass response Location in order to obtain content XSS?

In some basic steps: POST Request containing a photo with multipart/form-data. HTTP/1.1 302 Found respond with redirect back to formular Redirect to initial formular. In case 1 we are able to ...
0
votes
0answers
41 views

What is going on with these requests? HEAD with encoded backslash, and my site embedded in the url

I found these entries in my access log, and I found them rather weird. As I don't know what HEAD's purpose is here or what their intent was with this. I have the first couple as an example, but it's ...
4
votes
3answers
1k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
1
vote
1answer
376 views

URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

I was browsing for help on how to connect a PS2 controller to my pc. I found what I was looking for here: https://gaming.stackexchange.com/questions/262873/do-playstation-2-controllers-support-usb-...
10
votes
5answers
4k views

How safe is redirecting to another site?

Lets say I have a website at https://example.com/test. Whenever someone accesses this site, I want to just simply redirect them to https://example.com/Test. Are there any possible vulnerabilities ...
6
votes
3answers
256 views

What security holes are introduced by clicking an unknown link?

I recieved an email today that told me that "My account was comprised", an obvious fishing attempt, or so I thought. When I clicked the link, just for the fun of it, it brought me to a page which ...
0
votes
1answer
39 views

Redirection using HTTP meta tag

I've created a small project, where I scan a 1000+ sites for TLS implementation, including Does a https site exist Does the site redirect from http to https Various other info about the cert ...
1
vote
1answer
71 views

Phishing: allow # in user provided redirect URL?

I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned ...
0
votes
1answer
63 views

Avoiding redirects

I'm working on a site where users can input URLs. The URLs should point to sites where you can buy an item (for birthday/special event/...) It also sends out mails to e-mail addresses the user ...
27
votes
4answers
5k views

Why do compromised web sites often take you through multiple URL redirections?

Quoted form my course instructor's lecture: The following are the stages of a typical web attack: The victim visits a legitimate web site that has been compromised. The compromised web site ...
2
votes
2answers
198 views

Limiting redirect parameter to specific domain

Using PHP to set a Location header to redirect (e.g., upon login after being signed out) can be insecure if the redirect does not specify a domain. Here is an example: header('Location: ' . $_GET['...
31
votes
3answers
4k views

Should domains which only make redirects (aka tiny urls) be encrypted (https)?

For this question I will use the following domains: example.com - an online shop exmpl.com - a domain which is used for sharing items. exmpl.com will be used for redirects (e.g. http://exmpl.com/foo ...
-4
votes
1answer
522 views

How do I prevent the URL open redirect vulnerability? [duplicate]

I have created a vulnerable Code for Open redirect vulnerability, but now I want to secure it. But unfortunately, I didn't find on google so decide to come here., So, this is my html file code, in ...
4
votes
2answers
161 views

Is there any way to protect ourselves from annoying redirects?

It is not the first time I have been redirected to a malicious site. I was trying to download a song from a website when I clicked on download and was immediately redirected to a page which says "Your ...
3
votes
1answer
82 views

Why are downloads of Mac updates redirected to plain HTTP? [duplicate]

I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here. Funny thing is, when I right click and get the download link from ...
0
votes
1answer
101 views

Blackbox URL matching mechanism bypass for an open redirect

I'm currently testing a web application, which appears to have an open redirect vulnerability, since they receive a parameter redirect_url via GET. The application redirects the user to this URL later ...
4
votes
4answers
874 views

Redirect malware in BIOS or MBR can't remove it

I bought a brand new Dell Inspiron 15 7567 laptop factory sealed and new. I booted it up went through the install process and finally logged in. Opened the edge browser and went to Youtube to play ...
3
votes
1answer
60 views

Redirected to unsafe page on freshly installed Windows 10

This is my first question in security, so let me know if something about the question should be fixed. Some background information: My Windows 10 laptop was starting to get realy, realy slow when ...
3
votes
3answers
2k views

Is it unsafe to redirect to the referer URL?

Is it a problem when URLs in a web application redirect to the URL specified in the Referer header? It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be ...
2
votes
2answers
274 views

How can ISP's block a website specific content while using encrypted connection?

I'm learning about encryption and SSL certificates and I'm wondering: If an encrypted connection is used when connecting to a website using a SSL certificate, how can ISP/company manager/government (...
22
votes
3answers
8k views

Does HTTP redirect to HTTPS automatically?

When we enter an URL in a browser, it uses HTTP by default but if the server only support HTTPS, does the traffic redirect to https automatically without the user noticing? Am I right? If wrong, ...
0
votes
2answers
523 views

Trying to examine URL redirection in Wireshark

I clicked on a link (indistannews.com) and was redirected to a different website (sexiniowa.com). [Warning - the latter site is a pornography website]. I looked at the transaction in Wireshark to try ...
1
vote
2answers
218 views

Validate if URL (message) is coming from a trusted source

We are working on a redirecting page for our mobile apps. Users would go to a page like: https://mobileredirect.our-app.com?target=https://clientdomain.com/some_resource Mobile apps on iOS and ...
-1
votes
1answer
305 views

Open redirection URL

So i have been studying a lot of bug report regarding redirecting URL to a malicious website,most are understandable like when you log in or log out or you are just being redirected to another domain ...
0
votes
0answers
36 views

google crawled link shows different content

Recently I had a SEO spam hack on my website and when I search in Google it was showing malware content in the description. But one strange thing is link. If I access the domain via browser it shows ...
275
votes
3answers
20k views

How did “tech-supportcenter” phishers trick Google?

Related: Is the Web browser status bar always trustable? How can Google search change the location in a URL tooltip? I've always thought you can "hover" over a link to see where it really goes, ...
0
votes
2answers
187 views

Is there any way to force browse HTTP if all the traffic is redirected to HTTPS? [closed]

The webserver is configured to redirect all HTTP request traffic to HTTPS. And there seems to be different application running on 80 and 443. 443 is not vulnerable but there are lot of vulnerability ...
4
votes
1answer
887 views

Colons in URLs: Safe?

A friend asked me if it is relatively safe to click on the following link: https://disq.us/url?url=https%3A%2F%2Farstechnica.co.uk%2Finformation-technology%2F2017%2F01%2Fantivirus-is-bad%2F%3Av0Er-...
1
vote
1answer
56 views

Is it possible or common for a website (without ads) to only sometimes do a malicious redirect?

Using Chrome, I went to a website of a company we were researching, following a link from a google search, and got redirected to a malicious website. After killing Chrome and scanning for viruses, I ...
2
votes
0answers
97 views

How exactly do malicious ads run code?

Visiting quite a few malwaretisers (I think this is the term :) ), I get popups with address bar something like data:text/html;base64,PGh0bWw+PGJvZHk+...
0
votes
3answers
182 views

Page redirecting to “malicious” content

Recently I was visiting a web site that was is hosted in China (I can tell by the IP, it's assigned to an University over there). When I accessed their page today, it loaded but after the initial ...
1
vote
1answer
387 views

Malicious PHP script redirecting crawler traffic [closed]

Our website seems to have been recently compromised. The attacker had modified .htaccess to reroute traffic from search engine crawlers to a php script. The php script was encoded with Base64, then ...
4
votes
3answers
326 views

How can “unvalidated redirects and forwards” be exploited?

The OWASP example for Unvalidated Redirects and Forwards says that: The application has a page called “redirect.jsp” which takes a single parameter named “url”. The attacker crafts a malicious URL ...
1
vote
3answers
346 views

Security concerns of user-provided relative URL in Location: header

This is similar to this question, but a bit more specific. TL;DR; Are there any security concerns with allowing user-provided relative URLs in the Location: header on redirect? Background: I'm ...
3
votes
1answer
286 views

Redirect a user to a trap page using evil twin

The company where I work gave my team a "Security Information" training today and at the end they presented a video that exemplifies how vulnerable an open wireless network is. In this video the "...
2
votes
1answer
405 views

Computer, mobile or target site infected?

Something strange just happened to me, and I'm having issues telling where the fault is. I'm currently travelling by train, and using my mobile phone as a personal hot-spot (WiFi is WPA2 secured). I'...
2
votes
2answers
791 views

Why is tinyurl.com returning a phishing warning?

I have been using tinyurl.com for years for conveniently marking frequently used long URLs. This morning I went to create a tinyurl and this is the first time I saw: Questions: What authority has ...
1
vote
1answer
366 views

Why so many redirects in spam email URL?

A new spam email arrived today with a URL in it: http://agreementpoint.cricket/Q1U7E0r7l2OpXBD-OKDDyDDhDO-iKOXO It redirects many times before it completes reaches its final page. I am sort of ...
0
votes
0answers
293 views

Any way to exploit a URL section echoing into another URL?

I found a possible vulnerability vector in a website with a bug bounty program, and I don't want to pass it up, but I can't figure out a way to exploit it. The possible vector is that, when you go to ...
1
vote
1answer
396 views

Detecting malicious browser redirects

When you visit faecbook.com you'll be redirected to a page that has no benefits for the user visiting it. The page will either try to: Get your personal information. Have you download their malware. ...