Questions tagged [url-redirection]

URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

Filter by
Sorted by
Tagged with
0
votes
0answers
40 views

How do i ensure that links are from OneDrive / Google Drive?

I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are ...
0
votes
1answer
91 views

Is there a vulnerability in subdomain redirection, similar to Open Redirect

I found a website that has the parameter post_login_redirect= I can change to any existing and non-exisiting subdomains, but there is no possibility to redirect to another domain. The redirect occurs ...
1
vote
3answers
202 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
0
votes
1answer
64 views

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user'...
0
votes
1answer
179 views

Client HTTPS request redirection attack

Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS ...
0
votes
2answers
179 views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
0answers
33 views

Apache - Adding Redirect to sub-directory V/S changing DocumentRoot

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule. The reason I ask this, I have a website that is installed under /var/...
1
vote
1answer
120 views

Weird Google Redirect Bug?

So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
2
votes
1answer
95 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
0
votes
1answer
94 views

Is this redirect on my website dangerous?

I have this URL that I sometimes use to redirect my users. It looks like: https://mywebsite.com/?redirectTo= However, I'm checking if the domain part of the parameter ends with: google.com ...
2
votes
1answer
130 views

OAuth: how to prevent phishing with malicious redirect URIs

To quote the OAuth spec: If the resource owner denies the access request or if the request fails for reasons other than a missing or invalid redirection URI, the authorization server informs the ...
0
votes
1answer
66 views

Send a redirect after HTTPS certificate rejection

I would like to create a chain of HTTPS 302 redirects to a series of domains (for research purposes). I want also to make sure that I can do a redirect if one of the certificates in my chain has been ...
1
vote
0answers
62 views

Redirection to a blank page after searching on Google with the search bar of Firefox

Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese". When I use ...
1
vote
0answers
53 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
1
vote
1answer
83 views

What are the ways to identify a DNS cache poisoning attack?

Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
0
votes
1answer
146 views

why does google.com redirect if URL contains /amp followed by a schemeless domain name and optional resource?

Google recently announced a 'quiz' - more of a tutorial - on identifying phishing email: https://phishingquiz.withgoogle.com It includes a sample URL: https://google.com/amp/tiny url.com/y7u8ewlr ...
0
votes
0answers
104 views

DNS spoofing using MITMF

Is there a way to redirect all requests to a single website? I'm using MITMF to do the DNS spoofing and here is what I have: [[[A]]] # Queries for IPv4 address records *.(website request)=(ip to ...
1
vote
1answer
71 views

Limited open redirect ideas

This website (example.com for confidentiality) has an odd open redirect situation. It redirects after logging in by a URL parameter like example.com/login?returnURL=https://example.com I found that ...
1
vote
1answer
108 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
3
votes
2answers
205 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
4
votes
3answers
3k views

Clicking on a Google search result sometimes redirects to malicious site

Key Facts: On 3 separate occasions, in the past 3 months, with 3 different google search queries, I was redirected from the intended site to a malicious site. Always from a Google search using ...
2
votes
2answers
546 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
138 views

Suspicious Redirect to malicious website

While using a 3rd party platform my company is working with (e.g. platform.com) the following issue appeared. I clicked on a button in order to locally download an excel sheet (report) that was ...
1
vote
0answers
74 views

I clicked on an imgur link in an SE chat room and ended up at a url in India with a screen that looked like Google; what happened?

In a message in Space Exploration chat https://chat.stackexchange.com/transcript/message/46420646#46420646 there was a link to imgur.com which I naively assumed would be an image, GIF, or perhaps ...
1
vote
1answer
435 views

I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?

A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability ...
1
vote
3answers
389 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
-1
votes
1answer
1k views

301 Moved Permanently on nginx server

If I request this: http://mysite.com/\/\http://evilzone.org Response: HTTP/1.1 301 Moved Permanently Location: https://mysite.com/\/\http://evilzone.org Is it a vulnerability?
74
votes
4answers
10k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
1
vote
1answer
113 views

Any browsers where I could escape the URL with certain characters?

On this website, you can specify your YouTube channel URL and it makes a button on the profile page that will go to that URL. This text entry has no restrictions other than that it has to be less than ...
0
votes
1answer
196 views

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website http://example.com Now, you also have an SSL certificate, which means users can access the site securely using https://example.com But if I just write http://example.com ...
0
votes
1answer
466 views

“Go” subdomains with empty redirect url?

I've tested a lot of websites, and I've found that many sites have a "go.example.com" subdomain that returns the following error message: 404 Not Found The redirect url is empty This message makes ...
1
vote
2answers
410 views

Basic Auth over HTTP redirected to HTTPS - does it leak?

I'm creating a Flask API and I'm somewhat unfamiliar with the attack surfaces that exist in redirecting from HTTP to HTTPS, or requesting HTTP when HSTS header has been sent previously. Lets say a ...
2
votes
1answer
230 views

Suspicious redirect in Chrome

I was online and one of the sites randomly redirected to a site called mcafeesecurity.application-center.club. It was talking about how my mcafee has expired (my subscription is current). I scanned ...
-1
votes
1answer
196 views

Malicious URL - just Chrome [duplicate]

I was scanning a file on VirusTotal.com and it was identified malicious by only one antivirus (1/68 antiviruses) called CMC so I was interested to know about this antivirus, see if it's the deal or ...
2
votes
1answer
91 views

Why can't the client server speak directly to an identity provider like Facebook in OAauth 2.0

OAuth 2.0 used for authentication by Google makes sense given that the server and client both trust Google but not each other. As I understand the authorization code is passed back to the server (in ...
1
vote
1answer
1k views

URI redirect with only query parameters

Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters? In pseudo-code, creation of the URI looks like this: URI = "/example/path?" + "...
1
vote
1answer
1k views

How to bypass response Location in order to obtain content XSS?

In some basic steps: POST Request containing a photo with multipart/form-data. HTTP/1.1 302 Found respond with redirect back to formular Redirect to initial formular. In case 1 we are able to ...
5
votes
4answers
3k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
1
vote
1answer
984 views

URL changes to *.compute-1.amazonaws.com/ when entering website, do I have a problem?

I was browsing for help on how to connect a PS2 controller to my pc. I found what I was looking for here: https://gaming.stackexchange.com/questions/262873/do-playstation-2-controllers-support-usb-...
10
votes
5answers
5k views

How safe is redirecting to another site?

Lets say I have a website at https://example.com/test. Whenever someone accesses this site, I want to just simply redirect them to https://example.com/Test. Are there any possible vulnerabilities ...
6
votes
3answers
360 views

What security holes are introduced by clicking an unknown link?

I recieved an email today that told me that "My account was comprised", an obvious fishing attempt, or so I thought. When I clicked the link, just for the fun of it, it brought me to a page which ...
0
votes
1answer
78 views

Redirection using HTTP meta tag

I've created a small project, where I scan a 1000+ sites for TLS implementation, including Does a https site exist Does the site redirect from http to https Various other info about the cert ...
1
vote
1answer
83 views

Phishing: allow # in user provided redirect URL?

I am currently working on an application that requires authentication for some pages. In order to be nice to our users we provide the ability to specify a redirect url to which the user is returned ...
0
votes
1answer
81 views

Avoiding redirects

I'm working on a site where users can input URLs. The URLs should point to sites where you can buy an item (for birthday/special event/...) It also sends out mails to e-mail addresses the user ...
27
votes
4answers
5k views

Why do compromised web sites often take you through multiple URL redirections?

Quoted form my course instructor's lecture: The following are the stages of a typical web attack: The victim visits a legitimate web site that has been compromised. The compromised web site ...
2
votes
2answers
388 views

Limiting redirect parameter to specific domain

Using PHP to set a Location header to redirect (e.g., upon login after being signed out) can be insecure if the redirect does not specify a domain. Here is an example: header('Location: ' . $_GET['...
31
votes
3answers
4k views

Should domains which only make redirects (aka tiny urls) be encrypted (https)?

For this question I will use the following domains: example.com - an online shop exmpl.com - a domain which is used for sharing items. exmpl.com will be used for redirects (e.g. http://exmpl.com/foo ...
-4
votes
1answer
2k views

How do I prevent the URL open redirect vulnerability? [duplicate]

I have created a vulnerable Code for Open redirect vulnerability, but now I want to secure it. But unfortunately, I didn't find on google so decide to come here., So, this is my html file code, in ...
4
votes
2answers
183 views

Is there any way to protect ourselves from annoying redirects?

It is not the first time I have been redirected to a malicious site. I was trying to download a song from a website when I clicked on download and was immediately redirected to a page which says "Your ...
3
votes
1answer
92 views

Why are downloads of Mac updates redirected to plain HTTP? [duplicate]

I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here. Funny thing is, when I right click and get the download link from ...