Questions tagged [url]
The url tag has no usage guidance.
229
questions
1
vote
1
answer
1k
views
URL query string params Django security
I am new to Django and I am working on a website, where you can filter some articles using a normal GET url query string param. Theese params can be made from some input fields. I have found two ...
- 13
2
votes
1
answer
201
views
Is it a good rule of thumb to keep a URL as short as possible?
I was wondering if there are any security risks of having too long URLs for an internet site.
Of course there are things that don't matter if they're long or not, i.e. the actual hostname and ...
- 721
0
votes
1
answer
1k
views
How do I investigate a suspicious link?
I made a RuneScape account about a week ago. I stupidly responded to a scam by clicking on a link provided to me in the game. I think I may have a keylogger, which would explain why my new account was ...
-2
votes
1
answer
135
views
is it possible that an attacker catch a page name from history?
like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
- 117
0
votes
1
answer
306
views
Semantic URL Attack Mitigation
I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks
Example
updateprofile.php?uid=1
I can change to
updateprofile.php?uid=2
I can update the second user'...
- 57
0
votes
1
answer
552
views
Bypassing URL verification [closed]
I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods).
Here is a slightly modified version of the function:
public static bool IsValidURL(...
user159055
0
votes
1
answer
354
views
Is session id in url itself for all the requests an issue? [closed]
Is session id in url itself for all the requests an issue?
- 37
0
votes
1
answer
324
views
I was redirected to an infected site, what should I do?
I always avoid suspicious links, but recently, in one of my google searches, I clicked the first link on google (looked just a normal site), but it immediately redirected me to a weird news site (the ...
- 3
2
votes
1
answer
263
views
Weird Google Redirect Bug?
So I was recently show by a friend something that is happening to a real estate website. It seems that when their website is accessed from a regular URL request in browser it is fine however when ...
- 23
-2
votes
1
answer
179
views
how to decode this request [closed]
I need help for this. I got a request but I don't know what can I do:
GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1
Full request : https:...
- 1
0
votes
1
answer
153
views
Is this redirect on my website dangerous?
I have this URL that I sometimes use to redirect my users. It looks like:
https://mywebsite.com/?redirectTo=
However, I'm checking if the domain part of the parameter ends with:
google.com
...
1
vote
0
answers
146
views
How to determine if a website has been hijacked?
I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL.
I was surprised by this change, ...
0
votes
1
answer
491
views
Triaging malicious URLs
I'm quite new to the security field and learning my ways on how to triage certain events.
One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if ...
- 133
2
votes
4
answers
704
views
Testing malware or bad url's from a SIEM
What would be a good approach for testing malware or bad URL's from things picked up from my SIEM to validate them? I was told to set up a VM for these tests but don't want it to hit the internal ...
- 325
-3
votes
1
answer
644
views
How long would it take to brute force a URL path that's 5 characters long
example.com/[a-zA-Z0-9] the code can be any mix of numbers + uppercase/lowercase letters and it's 5 characters. How long would it take to brute force or is there an easier/faster way to do it?
86
votes
8
answers
15k
views
What attacks are made possible by public release of my web history?
Assume that my Internet history is made public (accidentally or on purpose). And this release is over 24 hours since the visits were made.
Also, assume that there aren't embarrassing sites on there: ...
- 823
2
votes
1
answer
406
views
Malicious Google Drive Links
Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
- 21
3
votes
2
answers
539
views
Can a URL that has no links to it be discovered? [duplicate]
Say there is a URL example.com/abunchofrandomsymbols and there are no links to it anywhere on the internet. Could it be discovered somehow?
My guess is a browser like Google Chrome could report it to ...
- 309
1
vote
2
answers
617
views
IP-whitelisting for DB access, does solution fit best practices?
All the data we have on our customers sits in our data-lake, which is hosted by one of our suppliers. Currently the security is such that a limited number of users has (limited) access to the database ...
- 139
2
votes
2
answers
814
views
How can AWS API Gateway be used to rapidly rotate credentials in this fashion?
Reading through this article, I hit a little wall of understanding. The author states:
This is because my laptop doesn’t have the secret weapon. Once you get
this up and running on an EC2 ...
- 1,069
1
vote
1
answer
1k
views
Unknown URL parameters in google query
I received an email which is classified as "potentially malicious" by my email program (Thunderbird), where links are actually a google URL query with extra parameters:
For example, the displayed ...
- 151
3
votes
1
answer
2k
views
I'm getting a suspicious link that starts with account.youtube.com, can someone explain what this link does?
A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability ...
- 200
3
votes
1
answer
389
views
What is httpvh:// and is it the result of something malicious?
I was working on a client's old website and I noticed that some of their YouTube links were broken and looked like this:
httpvh://www.youtube.com/watch?v=jNQXAC9IVRw
At first I assumed it was some ...
- 351
0
votes
1
answer
184
views
URL Filtering - What is the reason for blocking short url
By default many URL Filtering products will block the navigation of short URLs (e.g. the URL used by Twitter to link external pages).
What is the reason behind this block? Why I should prevent the ...
- 21
0
votes
2
answers
708
views
Check for vulnerabilities on website having an error with realpath PHP
I found a website with a download.php file which can get different values in the url parameter (e.g. www.example.com/download.php?url=value). When I give ../../ as a value for the url it throws me the ...
- 103
-1
votes
1
answer
418
views
Unable to utilise curl commands on website [closed]
There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
- 101
94
votes
8
answers
17k
views
Can secret GET requests be brute forced? [duplicate]
Say, I have on my server a page or folder which I want to be secret.
example.com/fdsafdsafdsfdsfdsafdrewrew.html
or
example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html
If the ...
- 921
0
votes
2
answers
3k
views
SQL Injection with an uninjectable URL
I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else.
...
- 1
3
votes
2
answers
226
views
Where do products like BlueCoat and ForcePoint get there URL categorizations from?
I recently had an issue where I released software which made use of a new URL and several of my customer sites complained that the software wasn't working within their wifi network. It turned out ...
- 193
1
vote
1
answer
905
views
Potentially dangerous request loads the page
I hosted an application in ASP.NET 4.0 webforms.
When I am browsing hostname/DressDetail.aspx?<script>alert(313)</script>&category=1&code=76 it is showing an error message like:
...
- 111
-1
votes
3
answers
233
views
Username appearing in URL when changing password [closed]
Use case:
User logs into the site.
User goes to the "change password" page
On the "change password" page, I noticed that the username is being displayed in the URL:
https://example.com/cp.aspx?un=...
- 13
30
votes
3
answers
15k
views
Generating one time URLs which can be revoked
I have a requirement to generate a one time use URL which should have the following features:
As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
- 403
16
votes
3
answers
3k
views
How to defend against homograph attacks?
Referring to this Wikipedia example of an homograph attack, the URL of Wikipedia had the Latin characters A and E replaced with a similar Cyrillic copy (wikipediа.org). These characters look so ...
- 291
0
votes
1
answer
2k
views
A potentially dangerous Request.Path value was detected from the client (&)
I was browsing the web and typed in a URL to visit, when I received the following response:
A potentially dangerous Request.Path value was detected from the client (&)
I did some research on ...
2
votes
1
answer
717
views
Path traversal using hash extension attack
I'm trying to write a PoC for path traversal using hash extension attack on a PHP site.
My obstacle is in specifying an acceptable string. The vulnerability is in in the URL:
http://127.0.0.1/...
- 23
2
votes
1
answer
80
views
How to secure a web service that allows custom user defined paths?
I'm working on a website that will rebuild data as an RSS feed based on a custom path.
For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (...
- 21
5
votes
1
answer
11k
views
Exploit LFI bug when a ".inc.php" is appended to the file name?
I'm trying to exploit a LFI bug. My link looks like this:
http://example.com/challenge/mypage.php?page=test
When I put /etc/passwd instead of test it shows me:
Warning: include() [function....
- 231
-1
votes
1
answer
2k
views
Passing a secret in url: as a part of the url or query string? [duplicate]
If I need to make get request to an html page and thus pass a secret via the url using https, is it true that I'd need to pass it in a query string versus a part of a path url?
my_domain.com/some_url/...
- 365
-5
votes
2
answers
2k
views
how can I access a ec2-xx-xx-xx-xx.us-west-2.compute.amazonaws.com ? this link won't open in my browser: [closed]
how can I access a us-west-2.compute.amazonaws.com ? this link won't open in my browser:
This page isn’t working didn’t send any data. ERR_EMPTY_RESPONSE
i'm not familiar with it, it starts with ...
2
votes
3
answers
307
views
What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?
A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server.
To demonstrate how to ...
- 131
0
votes
1
answer
112
views
Odd searches returned at the end of homepage url; possible to exploit?
I'm penetration testing a website right now (they have a policy and a system for it), and I noticed that the search feature filters brackets.
After some messing around, I also noticed if you search ...
- 481
15
votes
4
answers
33k
views
Is it possible to sniff HTTPS URLs? [duplicate]
From many posts, I know that almost everything in HTTPS or SSL connections is encrypted. Still, I am wondering, if it is possible to get the URLs out of such a connection if the computer that opens ...
- 161
8
votes
1
answer
77k
views
SQL injection: how to find urls to attack to [closed]
The last days I've been reading about SQL injection and most of the url examples I see are like the following:
get_int_filtered.php?id=1
get_int_groupby.php?id=1
get_int_having.php?id=1
get_int_img....
- 193
0
votes
1
answer
416
views
Phishing domain converting text due to special character?
Warning: The following links are phishing links, please do not sign in to them.
Today, a friend of mine came across the link hxxp://steạmcommunlty(dot)com/tradeoffer/new/. It's a phishing link, but I ...
- 3
2
votes
1
answer
1k
views
Exploitable URLs list
I have a web application which has recently been deployed to AWS.
In the last days, i got random requests to admin urls, like /admin.php, wp-admin.php etc. (obvious they are trying to find ...
- 123
4
votes
1
answer
6k
views
UUID in URL - how safe from accidental discovery is my proposed solution?
Here is what I want to do:
We create reports for customers, normally we send them as pdf to our customer who then shares them with colleagues across his company.
We want to switch now to digital ...
- 51
0
votes
1
answer
134
views
What was the purpose of this URL encoded php request against my webserver? [duplicate]
I saw this entry in my webserver log recently
179.x.x.x - - [19/Oct/2017:01:40:30 +1300] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%...
- 737
1
vote
2
answers
167
views
How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]
I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
- 223
0
votes
1
answer
525
views
Blackbox URL matching mechanism bypass for an open redirect
I'm currently testing a web application, which appears to have an open redirect vulnerability, since they receive a parameter redirect_url via GET. The application redirects the user to this URL later ...
- 1,019
1
vote
1
answer
141
views
Website's url parameter gets returned onto page- can that be exploited?
I'm currently trying to find a vulnerability in a website (yes, I have permission). I found a url with a parameter that, when I change the text in it, that text is set as the name for the background ...
- 481