URL redirection is a technique for making web resources available under more than one URL address, or moved to a different location while maintaining compatibility with previously published URLs.

learn more… | top users | synonyms

4
votes
4answers
285 views

Is it safe to redirect to URL parameter without filtering?

A webpage redirects to an URL given in parameter redirect without filtering it, like this: $newURL=$_GET["redirect"]; header('Location: '.$newURL); login.php?redirect=home.php If it echoes the ...
0
votes
2answers
86 views

Security concerns when using nginx as a lightweight URL shortener

I wish to use nginx as a lightweight URL shortener. To be exact, assuming my domain name is example.com, I have this most basic nginx.conf: events {} http { server { listen 80; location = ...
0
votes
2answers
57 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
7
votes
4answers
243 views

Bank website forwards to false site - formatted hard drive - still forwards

Summary: When I visit my bank's website, I get forwarded to a phishing mirror site. This has persisted through a re-format of my MacBook. Even on different browsers! Other computers on the same ...
3
votes
0answers
92 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
0
votes
0answers
19 views

Relative paths in Tomcat

I want to develop a web application that has a public and a restricted area. app/public app/private Public access to the web application is permitted through the app.com domain. There shall be a ...
0
votes
0answers
42 views

Domain redirection when using Evil Twin method?

When clients are connected to my fake access point, is there a way to redirect their requests to a different domain (eg.: google.com --> hotmail.com)? Could this be achieved maybe via iptables or the ...
0
votes
1answer
96 views

Redirect from HTTP to HTTPS; SSLStrip

Our web app home page redirects from HTTP to HTTPS. Our security consultant has told us this is a significant security weakness, that the redirect could be intercepted e.g. by SSLStrip. And therefore, ...
3
votes
2answers
92 views

Is URL redirection in PHP safe if I use ../../ as a prefix?

I am developing a PHP web app and I'm in the process of implementing a redirection functionality. I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
0
votes
2answers
88 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
0
votes
0answers
21 views

Handling assertions in responses statuses 302 in ZAP

After configuring all form Authentication in ZAP, I have faced an issue to assert successful login in ZAP. The response will arrive with the status "302" moved temporary EX: > HTTP/1.1 302 ...
9
votes
2answers
1k views

Redirecting/rickrolling intruders

While browsing for Node.js packages, I came across this one. It's purpose is to redirects crawlers away from a site, and by default it Rickrolls them. I find the idea amusing, but is it a good idea to ...
-2
votes
2answers
57 views

User's submitted ID in URLs, can it open some vulnerability? [closed]

On the website I'm building users can submit links to various of their personal page: YouTube accounts, Twitter, Facebook and a lot more. When he does so he furnishes the ID to his account. For ...
3
votes
0answers
59 views

All Devices on Network Being Redirected to Malware Download [closed]

I have a curious problem. I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and ...
4
votes
2answers
376 views

Preventing unvalidated redirects and forwards

Suppose you have a redirect page where the client is redirected to a URL from the query string: http://victim/redirect.aspx?url=http://evil/ You really need to be able to redirect to a another page ...
24
votes
2answers
568 views

Bypassing HTTP to HTTPS cached 301 redirect to use SSLstrip

I'm doing some pen. tests on a HTTPS (443) server that does not have HSTS implemented (no HSTS headers on response and the address is not on Chrome HSTS preload list). The problem is that in my ...
1
vote
0answers
123 views

Google images redirects to some page with random images [closed]

My customer have some photos on images.google.com that when clicked redirects to some pages and then stops on http://imageol.com/"something" with one random image. First I thought that it was a ...
6
votes
1answer
421 views

Is an HTTP 301 redirect to HTTPS, insecure?

For a website, I force a 301 redirect from http://login.example.com to https://login.example.com using a .htaccess file. As I read in this question this still imposes a security threat. I'm wondering ...
2
votes
2answers
128 views

Is this vulnerable to an insecure URL redirection attack

I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the ...
0
votes
0answers
44 views

OAuth 2.0 client redirect endpoint security

This question is about securing the redirect endpoint on the client side at the end of an "authorization code" flow. We have designed a back-end server that handles the OAuth 2.0 authorization ...
-2
votes
1answer
83 views

Why does ikea.com always redirect to ikea china?

Background: This question has been raised here and marked as duplicate. However, it is not fully addressed. To reproduce (not exactly): Set your DNS to 180.76.76.76 (the Baidu DNS ...
6
votes
3answers
670 views

Url Shortener vulnerability

I have service like tiny URL to shorten www.example.com/[6chars] URLs. However it includes person specified sensitive information. How can I protect the URL bruteforce scanners to the detect if URL ...
1
vote
4answers
141 views

Redirection Malware Infection

I have AVG Antivirus installed on my PC. My PC is infected with some kind of bonjovi redirection malware. It randomly opens up a new tab in Chrome and loads porn sites. I have had this infection in ...
3
votes
3answers
496 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
2
votes
1answer
297 views

302 redirect and the body on the page (you are redirected to …)

I have page which take URL on query and string and it. Then, you get redirected using 302 to another page, and the response of the page contains HTML code and the redirect header. Like this: ...
1
vote
1answer
112 views

How do I track IPs my computer is accessing?

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
-3
votes
1answer
150 views

Bank website has extension .rf is this safe?

Does anyone know if it is ok to proceed to my bank website even if every time I type the website in it opens pages with an .rf extension? What is that extension about? The bank is Regions dot com.
1
vote
1answer
89 views

open redirect via POST? [duplicate]

HTTP Request(POST): per_page=security.stackexchange.com&order=questions&redirect=HTTP://security.stackexchange.com/ So when I record my request I get these 3 parameters and when I edited it ...
1
vote
1answer
284 views

HTTP status 302 and subsequent redirect [closed]

I have sent a HTTP GET request to google.com and I get a 302 status. Now the location : url in http header is an http:// address, instead of https. When the browser visits this address I get back a ...
6
votes
2answers
389 views

Prevent phishing attacks through abuse of IOS URL scheme

I am building an IOS application that will have the following flow: A user completes registration from the web. Upon completion of registration, a link is sent to his email. Once the link is clicked ...
6
votes
3answers
650 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
12
votes
2answers
6k views

Sites being redirected to adult site in all devices [closed]

From past couple of days, we are facing this issue where sites are automatically being routed to an adult site, although we get a 404 Not Found HTTP error. First guess is obviously that my system is ...
0
votes
2answers
178 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
-1
votes
1answer
106 views

What are the heuristics for a malicious url? [closed]

I know that there is nothing like a safe website ,any website which is safe today could be hacked and its visitors could be served with latest malware. What I'm curious about is what checks can we ...
3
votes
1answer
1k views

How to fix open redirect vulnerability?

In redir.php: header("Location: {$_GET['addr']}"); For fixing open redirect vulnerability i can think of several ways: 1- (Side effect of) Using a security token (anti-csrf token): ...
2
votes
1answer
386 views

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think ...
5
votes
1answer
624 views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
5
votes
8answers
556 views

Checking “return” parameter in login page

My login page accepts the "return" parameter, which should contain URI to redirect user if he wasn't logged in and tried to access page which isn't accessible by unauthenticated users. It could be ...
1
vote
0answers
180 views

Open redirection unique token bypass

I am currently analyzing one job portal web application in which there is an open redirect vulnerability. Vulnerability description is as follows: Request type: GET Vulnerable Parameter: dest ...
2
votes
1answer
310 views

What is this attacker trying to accomplish?

My client is who is running a recent version of vBulletin is getting lots strange activity and I'm at a loss to explain what the attacker is trying to accomplish. The attacker registers a fake user ...
0
votes
3answers
595 views

Removing a Redirect Virus from Fedora Linux

Despite several attempts listed below certain websites are getting redirected to a certain ad website automatically, out of the blue on linux. When some website starts redirecting to this ad website ...
1
vote
1answer
79 views

Securing connection between redirect from A to B domain

I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A. The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site ...
4
votes
3answers
1k views

Unknown URL shows my website

I run a website at https://fastslots.co. I just discovered that I am getting requests from the URL https://canadaehtees.com/ that I have no affiliation with. When I load canadaehtees.com in my browser ...
2
votes
1answer
7k views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
1answer
441 views

Why add “***” in user-agent in this malicious code?

I found the following in every index file of my sites on a server I have. It looks like its redirecting all android users to some spooky Russian site. $ua = $_SERVER['HTTP_USER_AGENT']; ...
0
votes
1answer
291 views

Adding hash value to user supplied URL in a web application: any security benefit?

We administer a Java web application from an external supplier where we have access to the source code. The user is able to provide an external URL which is stored in a database and later on embedded ...
5
votes
1answer
471 views

What are the risks of accepting URL param for automatic redirection?

Can anybody name all the risks of the following scenario: User visits a page, but his session is expired, so he is auto-redirected to login page with his previous page and params added as a single ...
0
votes
1answer
833 views

URL Rewriting vulnerability

We modified our Session handling from cookie based to URL Rewriting. By doing this the session id gets transmitted as part of the URL. Now there is a vulnerability issue, where whoever uses this URL ...
0
votes
1answer
299 views

Detect referer check on redirect

I have a section of my web site that I only want reachable from another portion of my web site. I know that referer spoofing is trivially easy. But, if all requests from an incorrect referrer are met ...
1
vote
1answer
161 views

Android's Encryption mechanism

Well, according to my Android smartphone, it says the phone has been encrypted. Should I be worried if it has a malware or if I get hacked because I once clicked a link on a certain website then I ...