Questions tagged [url]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
3 views

Block specific URLs / URIs in browser, like the file:// protocol and other from being visited - How to set Browser policies [migrated]

How to block specific Uris or Urls in a browser? For example I don't want the file:// protocol can be visited or other specific locations by the user. Can I also add other policies and if so, how?
0 votes
0 answers
8 views

URL parameters for Facebook [closed]

I have been trying to check if I can get Facebook's usg and dv URL parameters but I can't find the source to check it. How do I figure out how they work?
0 votes
1 answer
59 views

URL redirects properly to all URL protocols except https://www

I have a domain that properly redirects as expected to protocol https://newhavendisplay.com, except for https://www.newhavendisplay.com, which triggers the "This connection is not private" ...
1 vote
1 answer
3k views

Demonstrating reflected XSS with GET Parameter and URL encoding

A client is developing a website which is vulnerable to reflected XSS through a GET parameter: https://example.com/vulnerable-url?")||true)alert("XSS");</script> I would like to demonstrate ...
30 votes
3 answers
14k views

Generating one time URLs which can be revoked

I have a requirement to generate a one time use URL which should have the following features: As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
2 votes
1 answer
567 views

What is this URL that loads each time Google Chrome spawns?

What does this URL do that opens each time Google Chrome loads? http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0....
1 vote
2 answers
99 views

DNS hijacking/poisoning effect on URL/URI and password manager autotype/autofill

A benefit to password managers, at least some of them, is that they can look at the URL and only use autotype/autofill when on the correct site, which can help prevent pharming since if instead of ...
2 votes
5 answers
2k views

How to analyze spam email URLs to detect exploits?

I'm receiving spam emails that, looking at the email headers, appear to be coming from a variety of computers around the planet. They're always the same type of email that contains invalid URLs inside ...
1 vote
1 answer
68 views

Azure Shared Access Signature (SAS) token security

I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible. When I generate a connection string there is a SAS token embedded in the URL. That token has ...
1 vote
2 answers
1k views

one-time link on 1ty.me

1ty.me is a website that allows you to send secret messages (password, nuclear code, etc.) to someone with a one-time link. So when someone receives the link and clicks on it, the secret message is ...
0 votes
1 answer
282 views

Encrypting PHI query params

In a bunch of APIs, there are several possible query parameters. Some of these may be PHI. So even if we are using HTTPS, they could go to a logfile or somewhere else and hence violate PHI. Was ...
2 votes
1 answer
406 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
0 votes
2 answers
3k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
0 votes
0 answers
41 views

Auto-login to account with PII using a random URL

I have a booking system where passengers need to add information that is quite sensitive (passport details etc). When they book, I generate a (difficult to crack) reference number, which they use to ...
0 votes
1 answer
24 views

Clicking on links [duplicate]

We are often warned about clicking on links in emails from unknown senders. That got me to wondering about other situations. For instance, you are searching the web looking to purchase an item and ...
0 votes
1 answer
30 views

Sharing a text file via Amazon S3 link with random words numbers [duplicate]

I would like to share a csv file to two or more separate computers/users. They would be running our software program which reads this text file. This is just initial idea for feedback please. To make ...
-1 votes
1 answer
309 views

can my ISP know which urls i'm visiting? If so then how to prevent it? [duplicate]

i'm using latest version of microsoft edge browser on windows 10 PC and i'm in India. I use cloudeflare DNS. i Checked my browser security on https://www.cloudflare.com/ssl/encrypted-sni/ and got this ...
0 votes
0 answers
32 views

How to know if I exposed my computer by clicking on a suspicious link? [duplicate]

I have recently received a message with a link on skype and very stupidly clicked to open it. The url was shortened, and after I clicked it became that deep web-like thing and it gave me a dead link ...
0 votes
2 answers
125 views

Parameter vulnerable for HTML injection but cannot exploit because of URL encoding

I found a HTML injection vulnerability but there is an issue. The following request returns the following: curl "https://redacted.com/xss/para?meter="><h1>Test\</h1>"<...
1 vote
1 answer
898 views

Potentially dangerous request loads the page

I hosted an application in ASP.NET 4.0 webforms. When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like: ...
-1 votes
1 answer
62 views

Where could I find a list of keys not to use for DES encrypting

We have a process that encrypts a URL, it uses DES encryption. I suspect someone may have figured out the key and is decrypting it to crawl information. This was set up many years ago, I just want to ...
15 votes
4 answers
33k views

Is it possible to sniff HTTPS URLs? [duplicate]

From many posts, I know that almost everything in HTTPS or SSL connections is encrypted. Still, I am wondering, if it is possible to get the URLs out of such a connection if the computer that opens ...
32 votes
5 answers
5k views

Is there any security benefit from emailing a "secure link"?

Sometimes I receive email messages from organisations I'm involved with saying something like: Alice at AnyCo has sent you a secure message Along with a link to access said message. Sometimes I'm ...
0 votes
2 answers
91 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
1 vote
1 answer
194 views

What is a safe way to display malicious URLs in research PDFs?

Is there a convention or safeguard to show malicious URLs in a paper if they are relevant to the topic? Some PDF viewers parse the text for URLs, which makes removing the hyperlink alone insufficient. ...
0 votes
1 answer
450 views

Making a phishing link look innocent

Situation I am learning about phishing attacks using OSINT, social engineering and some Kali tools to send a mail to a dedicated target, which contains an 'appealing' message and an ngrok link leading ...
0 votes
0 answers
11 views

Click on a link in a malicious email - how can i be hacked? [duplicate]

I accidentally clicked a link in a malicious email. The link has opened in my browser. I have not entered any username and password to login in. Could I have been hacked? I'd like to know what could ...
3 votes
1 answer
697 views

How does URL Encoding work?

I am learning about web security, but I'm very confused about URL Encoding. On PortSwigger, I learned that the URL http://127.0.0.1/admin can be written as http://127.0.0.1/%2561dmin by encoding a as ...
0 votes
1 answer
118 views

Is this safe from XSS?

I need to allow a user to pass unsafe text into an iframe URL: <iframe src="https://example.com?foo=INPUT"></iframe> Inside the iFrame render code, I have this: <!doctype ...
102 votes
5 answers
13k views

Can I safely preview a short link?

There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also: obfuscate the actual URL collect statistics about the usage ...
0 votes
1 answer
33 views

Multiple random requests for Non-Existent URLs from a single IP resulting in 404s

We sometimes get to see this behavior from a single IP address/logged in user - There are a lot of hits on our server that have .png at the end of the URL which results in a 404 because we don't have ...
-1 votes
1 answer
99 views

Automated malicious links delivered with e-mail (Reddit, LinkedIn, Package) [closed]

Recently my organisation has been flooded with phishing e-mails with different approaches: pretending to be Reddit or LinkedIn information about a new follower or package delivery status/problems, etc....
1 vote
1 answer
136 views

Suspicious hyperlinks (all hex URLs) in e-mail

I'm communicating with a job headhunter over LinkedIn and he sent me an e-mail containing information about a position. However, I noticed that all of the hyperlinks in the e-mail (even the one on ...
0 votes
2 answers
136 views

How big must the random string be and how long should a user activation link be available?

As I see in this answer that cryptographically secure randomness is a must in user activation urls such as: https://example.com/user-activate/^random_string^ But what are considered best practice ...
0 votes
1 answer
113 views

Is it necessary to use cryptographically-secure randomness in order to create URLs for user activation?

Usually once you register in a website you need to visit a url like: https://example.com/user_activate/^random_string^ Does the ^random_string^ necessarily need to be cryptographically pseudorandom ...
7 votes
1 answer
391 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
0 votes
0 answers
75 views

What ways a website could hack a device? [duplicate]

Is it possible that clicking a link would hack a device? For example: injecting a malicious code into the device directly from the link's host website connecting to the device remotely in a way ...
0 votes
1 answer
109 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
1 vote
1 answer
76 views

How are validation links getting triggered by a third party?

Question: It appears that somebody can intercept and read emails that I send from my server, although I have set up 2-Factor authentification for sudo-access I log all logins on my server (Did not ...
2 votes
4 answers
303 views

Why don't bigger companies buy similar domains to their main domain to prevent typosquatting?

One big threat out there is typosquat domains. For example instead of: steamcommunity.com some malicious actor will register the domain stearncornmunity.com and set up his fake steam login. Why do ...
0 votes
0 answers
2k views

crl.comodoca.com is a legit crl site, how can I determine it's legitimacy when bad actors are attempting to abuse uncertainty about the site

Yesterday I noted in my router logs that my wife's laptop accessed crl.comodoca.com. She was not using the machine at the time. A quick google search found three sites claiming this was an ...
1 vote
5 answers
883 views

Username in browser history (url) - is this a security problem?

We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
0 votes
1 answer
174 views

Can someone know my browser and headset model via browsing a link?

I recently clicked on a malicious link on Reddit When I was directed to the link, it asked me to do a couple of captchas. I did them and then was redirected back to Reddit. Then he said he could see ...
-1 votes
2 answers
314 views

Are the private URLs from Google Photos actually unguessable?

Maybe my math is wrong, but here it goes. If I generate a private url to share an album in Google Photos, I get something like this https://photos.app.goo.gl/***************** where the asterisks are ...
2 votes
2 answers
523 views

Can a JWT be all lowercase?

I'm using JWTs as part of an URL in order to direct a user to a specific site. I could have just used a UUID, but it's nice to have an expiry date in the link, as well as knowing whom the link is ...
0 votes
1 answer
834 views

How to secure my PHP url endpoints

I have a backend that I developed on PHP/MySql which will provide some URL endpoints in order to get data or post data. I am using those URL endpoints in my application (WebGL application). Now, the ...
23 votes
3 answers
4k views

Browser is accepting italic/bold Unicode as part of SPAM email's URL

This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
0 votes
2 answers
301 views

Why are there so many special characters in this phishing link?

I recently looked at a spam mail I received. Generally, I'd say it was a fairly standard phishing attempt, but one thing struck me as odd: The link that victims are supposed to click looks very weird ...
0 votes
1 answer
95 views

Algorithm to find 'owner' of an arbitrary (scammer) URL?

I'm getting a lot of scams on my mobile phone, and have just tried explaining to my wife how to find out who the 'owner' (network host name?) of a URL is before clicking on it. The basics are obvious -...
130 votes
4 answers
28k views

Is it safe to include an API key in a request's URL?

Lately I've seen plenty of APIs designed like this: curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY" Isn't it elementary that passing an API key in a query string as a part of ...

1
2 3 4 5