Questions tagged [url]
The url tag has no usage guidance.
229
questions
131
votes
10
answers
16k
views
Should I contact the manufacturer if their product allows access to other users' location information?
I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I'm hiking in the wilderness.
While testing out my product, I noticed that the ...
- 1,143
130
votes
4
answers
28k
views
Is it safe to include an API key in a request's URL?
Lately I've seen plenty of APIs designed like this:
curl "https://api.somewebsite.com/v1/something&key=YOUR-API-KEY"
Isn't it elementary that passing an API key in a query string as a part of ...
- 2,207
102
votes
5
answers
13k
views
Can I safely preview a short link?
There are a lot of different URL shorteners out there, like Bitly or TinyURL. Besides their main purpose of shortening a link, they also:
obfuscate the actual URL
collect statistics about the usage ...
- 1,633
94
votes
8
answers
17k
views
Can secret GET requests be brute forced? [duplicate]
Say, I have on my server a page or folder which I want to be secret.
example.com/fdsafdsafdsfdsfdsafdrewrew.html
or
example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html
If the ...
- 921
86
votes
8
answers
15k
views
What attacks are made possible by public release of my web history?
Assume that my Internet history is made public (accidentally or on purpose). And this release is over 24 hours since the visits were made.
Also, assume that there aren't embarrassing sites on there: ...
- 823
62
votes
3
answers
7k
views
Security risks of fetching user-supplied URLs
We are considering to add the following feature to our web application (an online product database, if it matters):
Instead of uploading an image, the user can provide the (self-hosted) URL of an ...
- 2,966
51
votes
6
answers
11k
views
Should a bank/financial service use external URL shortener services?
Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure ...
- 627
49
votes
1
answer
11k
views
In SQL injections why do they put "-- -" at the end of the URL?
I understand when they put a + at the end, URL treats it like a space.
I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
- 635
36
votes
3
answers
11k
views
Is HTTPS URL in plain text at first connection? [duplicate]
Let’s say I have never connected to the site example.com.
If this site is https and I write https://example.com/supersecretpage will the URL be sent in clear text since it's the first time I connect ...
- 385
32
votes
5
answers
5k
views
Is there any security benefit from emailing a "secure link"?
Sometimes I receive email messages from organisations I'm involved with saying something like:
Alice at AnyCo has sent you a secure message
Along with a link to access said message. Sometimes I'm ...
- 2,027
30
votes
3
answers
15k
views
Generating one time URLs which can be revoked
I have a requirement to generate a one time use URL which should have the following features:
As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
- 403
26
votes
4
answers
8k
views
Could receiving a URL link, not clicking on it, ever pose a security problem?
Could receiving in a text or an email, a URL link just like https://security.stackexchange.com/questions/ask of a website, which could be a pernicious one, ever pose a security problem at all? What I ...
- 371
24
votes
3
answers
7k
views
What's a "safe" URL shortening algorithm?
The situation: Currently, we are sending out emails and SMS to our users, which include a link to a form that each user has to fill out on a regular basis (an "eDiary"). As we need to be ...
- 367
23
votes
3
answers
4k
views
Browser is accepting italic/bold Unicode as part of SPAM email's URL
This is truly crazy. I received a SPAM email in which there is a URL crafted from apparent Unicode characters that surprisingly exist for italic/bold letters, which when I reported it to Google's spam ...
- 341
22
votes
2
answers
10k
views
Can javascript execution from address bar cause any harm to client's machine?
Given the fact that modern browsers these days prohibit JavaScript from having access to any resources on the client's machine, does JavaScript execution from the address bar pose any threat at all to ...
- 863
21
votes
3
answers
7k
views
Can ISPs selectively block a page URL on a HTTPS website leaving its other page URLs alone?
I want certain web pages blocked (within my country) by my Govt on a website that uses HTTPS on all pages. My Govt agrees that the specific URLs need to be blocked but expresses helplessness as their ...
- 327
19
votes
4
answers
3k
views
Is URL visible by ISP before HTTP request is 301 redirected to HTTPS?
Let's say I enter http://domain.com/... as a URL. The domain.com server performs a 301 redirect of all HTTP requests to the HTTPS version, so it shows me https://domain.com/....
Can my ISP see the ...
- 191
16
votes
3
answers
3k
views
How to defend against homograph attacks?
Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
- 291
15
votes
4
answers
33k
views
Is it possible to sniff HTTPS URLs? [duplicate]
From many posts, I know that almost everything in HTTPS or SSL connections is encrypted. Still, I am wondering, if it is possible to get the URLs out of such a connection if the computer that opens ...
- 161
14
votes
1
answer
6k
views
Is a plain password in the URL a potential security threat? [duplicate]
I'm in no way a security expert, in fact I'm just your average Joe with a question.
I was on my car insurance website, I registered and as I logged in I saw my password, not encrypted, in plain ...
- 143
11
votes
2
answers
2k
views
How to handle media files from untrusted sources?
I've been a heavy user of ffmpeg-based players and encoders for years, and though I've heard about numerous security issues, I always assumed that staying up-to-date was safe enough. However, I just ...
- 10.1k
9
votes
1
answer
1k
views
How can Google search change the location in a URL tooltip?
When hovering over a website link in Google search the tooltip says the link of the website (stackoverflow.com). But when I click it it goes to some Google page and then StackOverflow. But now if I go ...
- 477
9
votes
1
answer
889
views
Why is there "t=[your device]" in duckduckgo query URL?
I was just searching something on my raspberrypi via duckduckgo and realized that there is q=[my query]&t=raspberrypi&[rest of the URL] in the URL bar.
When i did the same query on my PC, ...
- 782
8
votes
1
answer
77k
views
SQL injection: how to find urls to attack to [closed]
The last days I've been reading about SQL injection and most of the url examples I see are like the following:
get_int_filtered.php?id=1
get_int_groupby.php?id=1
get_int_having.php?id=1
get_int_img....
- 193
8
votes
1
answer
173
views
Why am I getting url requests for pages I never had on my site?
On my Drupal site I'm getting strange requests for url paths that I have never had and have nothing to do with my site. Could some one explain why people (or bots) are looking for the following urls?
...
8
votes
1
answer
1k
views
What is the name for this type of URL attack?
Say a PHP page accepts URL path as a POST parameter (like the answer to this question):
$path = $_POST['url_path'];
file_get_contents('http://example.com' . $path);
A maliicious user POSTs url_path ...
- 33.7k
7
votes
3
answers
412
views
How to convince team mate about using an allowlist for a link created from a parameter?
Context
In our development team, we have to build a component. This component is a full client side one written in Javascript.
A client web application wishing to embed this component will call it ...
- 375
7
votes
1
answer
395
views
Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
6
votes
1
answer
1k
views
Are these encrypted URL values safe or could they be guessed?
One of our suppliers had a weakness on the secure section of his webpage. By changing ID's in the URL, we could see data that did not belong to us.
For example:
https://supplier.org/showItem.do?...
- 3,938
6
votes
1
answer
290
views
How does this possibly malicious phishing email link work?
I got a phishing email from a supposed realtor that wanted me to click on the following link
http://wonderit.net/f%23$%25%5e%29%28*%5e%25$%25%5eamg*&%5e%25$%23$%25%5e/
which I decoded as:
http:/...
- 163
5
votes
3
answers
4k
views
Is random URL token secure enough for file attachments and other user content? [duplicate]
Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
- 2,257
5
votes
1
answer
1k
views
What's the security risk of using a protocol-relative URL in a CSS stylesheet?
I used SonarQube to perform a static code analysis of my project and it detected a security vulnerability in one of my CSS files:
For security reasons, protocol-relative URLs should not be used.
...
- 14k
5
votes
1
answer
11k
views
Exploit LFI bug when a ".inc.php" is appended to the file name?
I'm trying to exploit a LFI bug. My link looks like this:
http://example.com/challenge/mypage.php?page=test
When I put /etc/passwd instead of test it shows me:
Warning: include() [function....
- 231
5
votes
1
answer
9k
views
Colons in URLs: Safe?
A friend asked me if it is relatively safe to click on the following link:
https://disq.us/url?url=https%3A%2F%2Farstechnica.co.uk%2Finformation-technology%2F2017%2F01%2Fantivirus-is-bad%2F%3Av0Er-...
5
votes
1
answer
2k
views
Security requirements for one time access code/token in the url
I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
- 2,257
5
votes
2
answers
933
views
Is URL redirection in PHP safe if I use ../../ as a prefix?
I am developing a PHP web app and I'm in the process of implementing a redirection functionality.
I know that redirection can be dangerous when it can be set on the client side and I use ../../ as a ...
- 53
4
votes
2
answers
866
views
Can random subdomain naming enhance security?
I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
- 143
4
votes
2
answers
4k
views
Preventing unvalidated redirects and forwards
Suppose you have a redirect page where the client is redirected to a URL from the query string:
http://victim/redirect.aspx?url=http://evil/
You really need to be able to redirect to a another page ...
- 41
4
votes
1
answer
6k
views
UUID in URL - how safe from accidental discovery is my proposed solution?
Here is what I want to do:
We create reports for customers, normally we send them as pdf to our customer who then shares them with colleagues across his company.
We want to switch now to digital ...
- 51
4
votes
2
answers
2k
views
Why is it dangerous to allow all characters in a URL?
Reviewing the configuration of CodeIgniter, I saw the following line:
$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-';
And the documentation it says:
/*
|------------------------------------------...
- 165
4
votes
1
answer
3k
views
Append query string parameters to form.action or a.href using Javascript?
I have an HTML page which is accepting any number of query string parameters, which I need to pass on to the next page the user visits by clicking links on my page. Basically, if the user comes to
...
- 43
4
votes
2
answers
3k
views
Are hiding and obfuscating the URL parameter keys a protection against tampering?
Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible when the keys are unknown (and hard to guess)?
Let's say we have the following URL:
https://example.com/...
- 6,337
3
votes
1
answer
14k
views
Google Drive photo security and publicly visible lh*.googleusercontent.com
I thought Google Drive was more secure than this.
If I upload a photo to Google Drive, I don't care that it's entrusted to them and I also assume someone working there can look at it. No big deal. ...
- 133
3
votes
2
answers
1k
views
S3 Bucket Name Obscurity as Security
Edited to clarify: *The bucket is used by EC2 instances that process its data and display parts of it to the user. The EC2-S3 interaction is invisible to the user. *
Can I assume that a public S3 ...
3
votes
3
answers
2k
views
URL escape before inserting user data into HTML URL parameter values?
Suggestion from OWASP Cross Site Scripting Prevention Cheat Sheet:
RULE #5 - URL Escape Before Inserting Untrusted Data into HTML URL Parameter Values
Rule #5 is for when you want to put untrusted ...
- 561
3
votes
1
answer
2k
views
Can the creator of Bitly links be determined from the link?
Let's say that an attacker is using Bitly's web API to generate large numbers of bitly links.
If we have the bitly link (e.g. http://bit.ly/1gX2dD0), is there any way to trace that bitly link back to ...
- 131
3
votes
1
answer
389
views
What is httpvh:// and is it the result of something malicious?
I was working on a client's old website and I noticed that some of their YouTube links were broken and looked like this:
httpvh://www.youtube.com/watch?v=jNQXAC9IVRw
At first I assumed it was some ...
- 351
3
votes
2
answers
539
views
Can a URL that has no links to it be discovered? [duplicate]
Say there is a URL example.com/abunchofrandomsymbols and there are no links to it anywhere on the internet. Could it be discovered somehow?
My guess is a browser like Google Chrome could report it to ...
- 309
3
votes
1
answer
705
views
How does URL Encoding work?
I am learning about web security, but I'm very confused about URL Encoding.
On PortSwigger, I learned that the URL http://127.0.0.1/admin
can be written as http://127.0.0.1/%2561dmin
by encoding a as ...
- 217
3
votes
1
answer
2k
views
I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?
A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability ...
- 200