Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [url-redirection]

URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

0
votes
2answers
98 views

How to conduct this MITM attack

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
0answers
30 views

Apache - Adding Redirect to sub-directory V/S changing DocumentRoot

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule. The reason I ask this, I have a website that is installed under /var/...
1
vote
1answer
91 views

Weird Google Redirect Bug?

So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
2
votes
1answer
55 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
0
votes
1answer
90 views

Is this redirect on my website dangerous?

I have this URL that I sometimes use to redirect my users. It looks like: https://mywebsite.com/?redirectTo= However, I'm checking if the domain part of the parameter ends with: google.com ...
2
votes
1answer
90 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
0
votes
1answer
60 views

Send a redirect after HTTPS certificate rejection

I would like to create a chain of HTTPS 302 redirects to a series of domains (for research purposes). I want also to make sure that I can do a redirect if one of the certificates in my chain has been ...
1
vote
0answers
38 views

Redirection to a blank page after searching on Google with the search bar of Firefox

Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese". When I use ...
1
vote
0answers
45 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
1
vote
1answer
72 views

What are the ways to identify a DNS cache poisoning attack?

Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
0
votes
1answer
83 views

why does google.com redirect if URL contains /amp followed by a schemeless domain name and optional resource?

Google recently announced a 'quiz' - more of a tutorial - on identifying phishing email: https://phishingquiz.withgoogle.com It includes a sample URL: https://google.com/amp/tiny url.com/y7u8ewlr ...
0
votes
0answers
84 views

DNS spoofing using MITMF

Is there a way to redirect all requests to a single website? I'm using MITMF to do the DNS spoofing and here is what I have: [[[A]]] # Queries for IPv4 address records *.(website request)=(ip to ...
1
vote
1answer
53 views

Limited open redirect ideas

This website (example.com for confidentiality) has an odd open redirect situation. It redirects after logging in by a URL parameter like example.com/login?returnURL=https://example.com I found that ...
1
vote
1answer
89 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
3
votes
2answers
175 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
4
votes
3answers
1k views

Clicking on a Google search result sometimes redirects to malicious site

Key Facts: On 3 separate occasions, in the past 3 months, with 3 different google search queries, I was redirected from the intended site to a malicious site. Always from a Google search using ...
2
votes
2answers
334 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
119 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
1
vote
0answers
67 views

I clicked on an imgur link in an SE chat room and ended up at a url in India with a screen that looked like Google; what happened?

In a message in Space Exploration chat https://chat.stackexchange.com/transcript/message/46420646#46420646 there was a link to imgur.com which I naively assumed would be an image, GIF, or perhaps ...
1
vote
1answer
316 views

I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?

A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability ...
1
vote
3answers
339 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
-1
votes
1answer
886 views

301 Moved Permanently on nginx server

If I request this: http://mysite.com/\/\http://evilzone.org Response: HTTP/1.1 301 Moved Permanently Location: https://mysite.com/\/\http://evilzone.org Is it a vulnerability?
74
votes
4answers
10k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
1
vote
1answer
110 views

Any browsers where I could escape the URL with certain characters?

On this website, you can specify your YouTube channel URL and it makes a button on the profile page that will go to that URL. This text entry has no restrictions other than that it has to be less than ...
0
votes
1answer
172 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
0
votes
1answer
366 views

“Go” subdomains with empty redirect url?

I've tested a lot of websites, and I've found that many sites have a "go.example.com" subdomain that returns the following error message: 404 Not Found The redirect url is empty This message makes ...
1
vote
2answers
345 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
2
votes
1answer
209 views

Suspicious redirect in Chrome

I was online and one of the sites randomly redirected to a site called mcafeesecurity.application-center.club. It was talking about how my mcafee has expired (my subscription is current). I scanned ...
-1
votes
1answer
180 views

Malicious URL - just Chrome [duplicate]

I was scanning a file on VirusTotal.com and it was identified malicious by only one antivirus (1/68 antiviruses) called CMC so I was interested to know about this antivirus, see if it's the deal or ...
2
votes
1answer
90 views

Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other. As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
582 views

URI redirect with only query parameters

Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters? In pseudo-code, creation of the URI looks like this: URI = "/example/path?" + "...
1
vote
1answer
867 views

How to bypass response Location in order to obtain content XSS?

In some basic steps: POST Request containing a photo with multipart/form-data. HTTP/1.1 302 Found respond with redirect back to formular Redirect to initial formular. In case 1 we are able to ...
0
votes
0answers
62 views

What is going on with these requests? HEAD with encoded backslash, and my site embedded in the url

I found these entries in my access log, and I found them rather weird. As I don't know what HEAD's purpose is here or what their intent was with this. I have the first couple as an example, but it's ...
5
votes
4answers
3k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
1
vote
1answer
818 views

URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

I was browsing for help on how to connect a PS2 controller to my pc. I found what I was looking for here: https://gaming.stackexchange.com/questions/262873/do-playstation-2-controllers-support-usb-...
10
votes
5answers
4k views

How safe is redirecting to another site?

Lets say I have a website at https://example.com/test. Whenever someone accesses this site, I want to just simply redirect them to https://example.com/Test. Are there any possible vulnerabilities ...
6
votes
3answers
301 views

What security holes are introduced by clicking an unknown link?

I recieved an email today that told me that "My account was comprised", an obvious fishing attempt, or so I thought. When I clicked the link, just for the fun of it, it brought me to a page which ...
0
votes
1answer
69 views

Redirection using HTTP meta tag

I've created a small project, where I scan a 1000+ sites for TLS implementation, including Does a https site exist Does the site redirect from http to https Various other info about the cert ...
1
vote
1answer
80 views

Phishing: allow # in user provided redirect URL?

I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned ...
0
votes
1answer
69 views

Avoiding redirects

I'm working on a site where users can input URLs. The URLs should point to sites where you can buy an item (for birthday/special event/...) It also sends out mails to e-mail addresses the user ...
27
votes
4answers
5k views

Why do compromised web sites often take you through multiple URL redirections?

Quoted form my course instructor's lecture: The following are the stages of a typical web attack: The victim visits a legitimate web site that has been compromised. The compromised web site ...
2
votes
2answers
357 views

Limiting redirect parameter to specific domain

Using PHP to set a Location header to redirect (e.g., upon login after being signed out) can be insecure if the redirect does not specify a domain. Here is an example: header('Location: ' . $_GET['...
31
votes
3answers
4k views

Should domains which only make redirects (aka tiny urls) be encrypted (https)?

For this question I will use the following domains: example.com - an online shop exmpl.com - a domain which is used for sharing items. exmpl.com will be used for redirects (e.g. http://exmpl.com/foo ...
-4
votes
1answer
2k views

How do I prevent the URL open redirect vulnerability? [duplicate]

I have created a vulnerable Code for Open redirect vulnerability, but now I want to secure it. But unfortunately, I didn't find on google so decide to come here., So, this is my html file code, in ...
4
votes
2answers
179 views

Is there any way to protect ourselves from annoying redirects?

It is not the first time I have been redirected to a malicious site. I was trying to download a song from a website when I clicked on download and was immediately redirected to a page which says "Your ...
3
votes
1answer
92 views

Why are downloads of Mac updates redirected to plain HTTP? [duplicate]

I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here. Funny thing is, when I right click and get the download link from ...
0
votes
1answer
144 views

Blackbox URL matching mechanism bypass for an open redirect

I'm currently testing a web application, which appears to have an open redirect vulnerability, since they receive a parameter redirect_url via GET. The application redirects the user to this URL later ...
4
votes
4answers
976 views

Redirect malware in BIOS or MBR can't remove it

I bought a brand new Dell Inspiron 15 7567 laptop factory sealed and new. I booted it up went through the install process and finally logged in. Opened the edge browser and went to Youtube to play ...
3
votes
1answer
65 views

Redirected to unsafe page on freshly installed Windows 10

This is my first question in security, so let me know if something about the question should be fixed. Some background information: My Windows 10 laptop was starting to get realy, realy slow when ...
4
votes
3answers
3k views

Is it unsafe to redirect to the referer URL?

Is it a problem when URLs in a web application redirect to the URL specified in the Referer header? It's not an open redirect like any of the /whatever?url=evil.com examples I've seen, that can be ...