Questions tagged [url-redirection]

URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

Filter by
Sorted by
Tagged with
0 votes
0 answers
48 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
user avatar
0 votes
0 answers
21 views

Explotation of reload/redirect through javascript

While working on a site (https://website.com/site/site.apexp) the site redirects through a javascript function: <html> <script> function redirectOnLoad() { var escapedHash = ''; ...
user avatar
  • 1
0 votes
2 answers
95 views

Does the HTTP status code 302 guarantee no other content was served as part of the same HTTP response?

Does receiving the HTTP 302 status code from a domain A guarantee in any shape or form that there was no JavaScript ran or any additional content (external or not) loaded from that domain A? The ...
user avatar
0 votes
0 answers
80 views

window.history.pushState as a solution to document.referer

the problem: Having URL parameters in a web page URL address to add functionality to a website (authenticate/authorize showing stuff in the UI, being used in further http requests on load, etc.) can ...
user avatar
103 votes
5 answers
12k views

Can I safely preview a short link?

There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also: obfuscate the actual URL collect statistics about the usage ...
user avatar
0 votes
1 answer
101 views

Analyzing potential threats from re-directs

I just clicked a link on pinterest to take me to the source website. Upon clicking, it took me to the following 5 links: https://s3.amazonaws.com/bishkek0303/decorative-graphic-design-element-in-...
user avatar
0 votes
2 answers
88 views

Open Redirects - Can they be done without modifying server side code?

Open redirects showed up in the news this week thanks to Microsoft. While this is very old issue, this is a new topic for me. The concern seems to be that a user hovering over a link may not read ...
user avatar
  • 103
0 votes
0 answers
302 views

Stored XSS cookie stealing, but a loop of redirection

I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack. So on my remote server I run an HTTP server with Flask using python where there is ...
user avatar
3 votes
1 answer
377 views

Hijacking URL that ends with a trailing slash

I am pentesting an API which makes a backend call to https://example.org/ and appends any input you provide it (for example, if you provide test it will call https://example.org/test). I am trying to ...
user avatar
  • 79
0 votes
1 answer
87 views

Is there any way that I can redirect to other site when someone access to a particular site? [closed]

On my company's computer, someone play the internet game so I want to deny the site and redirect to another site. Or If someone access the game site redirect to other site right off on computer ...
user avatar
0 votes
1 answer
171 views

Open redirect adding symbol

I know there are some questions around open redirects but with this one I have some additional questions. In order to not release the assets I am going to replace the asset with "exampleeee.com&...
user avatar
2 votes
1 answer
266 views

Unusual Google Chrome Download Redirection

When I go to https://www.google.com/chrome/, I get redirected to sign in and then forwarded to some app engine link as can be seen in the continue parameter of the following URL: https[:]//accounts[.]...
user avatar
0 votes
1 answer
117 views

Does an url that redirecting infinitely have any impact to website?

I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times. For ...
user avatar
0 votes
1 answer
117 views

Can this Javascript redirect be exploited in some way?

Since I can modify pathname, search and hash value could I leverages this in some way? var URL = window.location.hostname+window.location.pathname + window.location.search + window.location.hash; ...
user avatar
  • 477
0 votes
1 answer
103 views

URL shortener who does nothing according to the owner [closed]

I talk in a security forum, and sometimes a moderator share links to sources about things he talk about, but when I hover on these links, the link is different the the source it self. It is actually a ...
user avatar
  • 1
1 vote
1 answer
131 views

What are the risks associate with accessing Same web application with two different URLs?

We have done vulnerability analysis with third party security team. They have mentioned one point as critical findings but i don't understand risk associated with it and suggested remedial action also ...
user avatar
  • 658
1 vote
1 answer
151 views

How to exploit open redirect vulnerability which must contain the original url

Let's say I have the following url: https://secure.sub.domain.com/?continue=https://sub.domain.com I found out that I can put anything I want before sub.domain.com in the continue parameter as long as ...
user avatar
  • 11
0 votes
1 answer
205 views

Redirection - Different Website from Different Computer

There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
user avatar
0 votes
1 answer
1k views

How do I redirect HTTPS site to another HTTPS site over LAN using a linux? [closed]

Is there a tool, or a command for linux that can make possible to redirect HTTPS site to another HTTPS site on LAN? i'm using Kali Linux, and all the tools and commands that i found was to redirect ...
user avatar
  • 1
3 votes
0 answers
337 views

Preventing open redirects / xss on a variable return url / iframe

Let's assume I have a website where I have to either redirect the user to another URL or include another URL in an iframe, that is given by a GET parameter. I cannot use HMAC when the URL is created. ...
user avatar
  • 139
1 vote
2 answers
110 views

How some sites prevent cross-site requests through referrer although there are redirections allowed

I read about referrer header that some sites use to allow only requests made by the pages of the site. So if I make a page hacker.com, and let this page make a request to https://twitter.com/i/flow/...
user avatar
1 vote
1 answer
197 views

How short can a shortened base 62 url path be and be reasonably protected from a brute force attack?

If one is creating pseudo-random base 62 url paths, and one didn't want those paths to be reasonably vulnerable to brute force attack. How short could they be? Reasoning Now one could have expiring ...
user avatar
1 vote
0 answers
211 views

Router infected; Factory reset not working [closed]

Recently, I was being redirected (occasionally, not every time) by "ilkmawgod.site" (no information on google) to malicious webpages. I scanned my every thing using quick heal, but it didn't find ...
user avatar
1 vote
1 answer
134 views

Security risks in 301/2 redirect HTTPS to HTTP

I have noticed that my employer's website, which handles sensitive information, redirects some pages from HTTPS to HTTP on another domain. This feels like a poor practice. Are there any security ...
user avatar
-2 votes
2 answers
133 views

Dns poisoning for any search [closed]

DNS poisoning works only if we open a certain website. For example, a victim enters 192.168.21.56 in a browser, it will be directed to a phishing page. What if we want to redirect the victim to 192....
user avatar
0 votes
1 answer
591 views

How to find PHP filename and ID of the URL?

.htaccess is now a very common URL rewrite to make it SEO friendly and cover the database IDs. What are the ways to explore php file on the server given to URL via .htaccess? Example : The URL is ...
user avatar
  • 1
1 vote
1 answer
189 views

How can i cause a redirect in browser?

I'm able to edit a parameter which is then reflected inside a link. I'd like to know how and if it's possible to cause a redirect. In shorts when i edit the parameter example like this example=/test....
user avatar
  • 19
1 vote
1 answer
94 views

What is the ideal technique to protect unauthorized redirects

I'm looking for the best way to secure unauthorized redirects from GET parameter where url=http://example.com I'm thinking about creating an unique identifier like using a hashing function (md5 for ...
user avatar
  • 13
1 vote
0 answers
113 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
user avatar
  • 111
-5 votes
2 answers
158 views

How can HSTS preloading be avoided?

Preloading is a primitive operation. You must preload for a year or more, and "be aware that inclusion in the preload list cannot easily be undone," according to the registration tool. Therefore, if ...
user avatar
2 votes
0 answers
132 views

Passing 3rd Party Access Token in redirection URL of 3rd Party Website

I am integrating a website with 3rd party API. The 3rd party site allows me to generate Access Token by using Client Key/Client Secret. In one of the pages, I need to redirect to 3rd party site 's ...
user avatar
1 vote
0 answers
588 views

Purpose of this link that redirects to random websites [closed]

Here is a link from an SMS I received abev1o.yzv.jp. This link redirects to a somewhat random website (twitter, youtube, CNN, and others). I downloaded the page using curl: https://gist.github.com/...
user avatar
  • 111
0 votes
1 answer
141 views

Security Considerations To Account for When Redirecting From Microservice to Another

I am evaluating the above service design where I want to have mechanism to pass a user through multiple microservices. In this simple example, the user goes through a sign-up process and once done, ...
user avatar
  • 111
1 vote
1 answer
273 views

False Positive of Cleartext Submission in (CWE-319) in Burp?

In a recent execution of a spider, Burp reported cleartext submission of a password CWE-319, but the evidence in the report is merely the preceding GET request of a non-existant page, redirected via ...
user avatar
  • 113
1 vote
2 answers
313 views

How to report error if redirect_uri doesn't match?

How should the auth server (IDP) report the error if the authorisation request redirect_uri doesn't match the configured redirect_uri for the given client? Let's consider concrete example: auth.com ...
user avatar
0 votes
1 answer
220 views

Referer value reflected in location response? [duplicate]

I found a login form on a website that redirects you regardless if the insert credentials are correct or wrong (302 redirect). I noticed that the value of the header Referer: is sent to header ...
user avatar
3 votes
1 answer
128 views

Can a user be redirected to a malicious website if only a part of the url can be controlled by user input?

I have a site located at https://gooddomain.com/wonderful?returnPath=goodThings which redirects me to https://gooddomain.com/somegoodplace/goodThings At the server side, the redirect is defined ...
user avatar
  • 3,851
7 votes
1 answer
1k views

How Concerning Is This X-CU-modified: FAKECU Text Attack?

A user clicked on the link of this email and entered their credentials, thinking the message was legitimate. However, the link didn't redirect to the fake site, and instead their mail client sent them ...
user avatar
0 votes
2 answers
129 views

What was the point of Implicit Grant Flow in OAuth 2.0?

I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs ...
user avatar
1 vote
2 answers
158 views

How does "automatic" redirection occurs from a legitimate website to a scammy one?

Using Firefox on Windows 10 every time when I visit ebay.com I get redirected to a clearly fraudulent website telling me I've won some prize and asking me to enter my personal information. The ...
user avatar
  • 119
1 vote
1 answer
246 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
user avatar
  • 11
0 votes
2 answers
464 views

How does someone know i clicked a link in an email? URL spoofing? JSON?

How do hackers/scammers know that I clicked a link? Why is my personal info in the url redirect link? Is this info then being stored in a database and the hacker/scammer knows that because this ...
user avatar
0 votes
2 answers
123 views

Is there any security reason for re-directing to the main/mobile page after login?

Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
user avatar
  • 2,051
1 vote
2 answers
488 views

infinity redirection as Dos Attack

I was wondering that infinite redirection could be used as a dos attack in my case, I have this test.php <?php $url = $_GET['url']; header('Location: '.$newURL); ?> ...
user avatar
1 vote
0 answers
531 views

mitmproxy request URL redirection does not work

I need to redirect the user's request in such a way when a user enters: https://a.com the mitmproxy redirect it to: https://www.newsite.com/?somepage From a previous post, I found this script in the ...
user avatar
2 votes
2 answers
634 views

Is there a vulnerability in subdomain redirection, similar to Open Redirect

I found a website that has the parameter post_login_redirect= I can change to any existing and non-exisiting subdomains, but there is no possibility to redirect to another domain. The redirect occurs ...
user avatar
1 vote
3 answers
718 views

Is there a way around HTTPS being redirected to HTTP?

I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
user avatar
  • 1,057
0 votes
1 answer
293 views

Semantic URL Attack Mitigation

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks Example updateprofile.php?uid=1 I can change to updateprofile.php?uid=2 I can update the second user'...
user avatar
  • 57
0 votes
1 answer
935 views

Client HTTPS request redirection attack

Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS ...
user avatar
0 votes
2 answers
1k views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
user avatar

1
2 3 4 5