203

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page? The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement. Rather, the displayed ...


119

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. Very few people will click on a link to https://evilphishingsite.example.com, but they might click on https://catphotos.example.com?redirect=https://...


66

Secure your cookies In settings.py put the lines SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True and cookies will only be sent via HTTPS connections. Additionally, you probably also want SESSION_EXPIRE_AT_BROWSER_CLOSE=True. Note if you are using older versions of django (less than 1.4), there isn't a setting for secure CSRF cookies. As a quick ...


62

If Bob is trying to type products and mistypes product, he already knows there's a URL in the website for products and so you're not telling him anything he doesn't know. If you don't suggest URLs that shouldn't be public, you won't have any issues. Why use a 404 message though, and not do an immediate redirect?


52

No, at the moment no major browsers would redirect to HTTPS automatically. The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or they can register themselves into HSTS preload list, and users can install browser plugins to always load HTTPS based on a white list or even to always try HTTPS ...


48

Should redirect sites use HTTPS If the main site uses HTTPS then the redirect site should too. What attacks are possible if it does not Passive Attacker Can see every item looked at by the user May get extra information (which site/chat linked to the page) Active Attacker Anything a passive attacker can, and... Can MITM the connection and use ...


41

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow). Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper ...


39

I noticed that from a Google search, if I take the referer (www.google.com) out of the web request to changewise.biz, it does not redirect to the spam site. If I do not take the referer out, I get the spam site (and subsequent requests always get it since it is then cached in the browser). So I think it is not faulty old Google data, but something in your ...


32

If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users. From https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web ...


31

There are actually two cases here: A site which is serving malicious ads (Malvertising) In this case the attacker does not compromise the site itself but is misusing targeted ads to select the victim based on its specific capabilities (browser, OS, geolocation,...) and attack it. Due to the way targeted ad delivery works it uses a lot of redirect between ...


30

/test and /Test are both hosted on example.com … so it's just a page redirect not a domain redirect … this is a non-issue. People redirect like this all the time, for instance redirecting from HTTP to HTTPS is pretty much industry standard at this point.


24

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer. What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple ...


23

I would suggest that your apache process itself is backdoored, because even access to non-existing pages with something like google\. in the referer gets redirected. E.g. like GET /this-page-does-not-exist/ HTTP/1.0 Host: www.changewise.biz Referer: foobargoogle. Just search google for 'apache backdoor redirect referer' - you will find enough reports of ...


22

If your devices can connect to the internet (without redirection to Adulttube.info) through 3/4G then I suppose your router is infected with a trojan (Trojan:32/DNSChanger) https://www.f-secure.com/v-descs/dnschang.shtml Trojan :32/DNSChanger compromised the router weak default password using brute-force attacks. The Trojan then changed the routers DNS ...


21

You should use * in your URI, creating URI injection point(s). So instead of using: sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2" use: sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*" See sqlmap wiki for more usage options. From that page: URI injection point There are special cases when injection point is ...


21

YES, and its an OWASP top 10 violation: OWASP A10 - Unvalidated Redirect. These are valuable for phishing and spam. Recently it was uncovered that spammers where exploiting Open Redirect vulnerabilities on US .gov websites for profit.


18

The simple answer is that you can't be 100% sure. Here are 5 browser extensions that automatically expand short URLs for you to check visually if the destination website is familiar. But even familiar sites can contain malware or other attacks like Cross Site Scripting. Google Chrome and Mozilla Firefox automatically perform checks against the Google Safe ...


18

So I just stumbled upon this today and got a similar message: https://www.linkedin.com/slink?code=eiurEkp?61778=myname First I tried the first part: https://www.linkedin.com/slink?code=eiurEkp This ends here: http://281-inteligen.thiscontentedmotion.com/de/ihel/inteligen/ - a scammy article about somebody saying that someone said that this pill will just ...


18

Implemented correctly, there are no issues with this. There are two things you should look out for (I assume that test is not static here, but user supplied, so you eg want to upper-case every path): Open Redirect: If your redirect is implemented incorrectly, it might be possible for an attacker to redirect outside of your domain, which could be used in ...


17

Unvalidated redirects do not necessarily apply here. An unvalidated redirect is something more along the lines of an attacker being able to send a victim to a destination of the attacker's choosing. If you read the example on the OWASP page you linked at the bottom, you will see that the attacker crafts a URL that can be sent to a victim using social ...


17

From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual link), i.e. something like <a href=http://attacker> http://example.com </a> This trick was successfully neutralized by some secure mail gateway ...


16

Since you're doing a 301 redirect over HTTP, someone could man-in-the-middle that connection and redirect you anywhere they wanted - in particular they could actually not redirect you at all, and instead get between your computer and https://login.example.com, monitoring your connection and serving you its contents under the name http://login.example.com ...


15

This is known as Referer spam, here is short description from Wikipedia: Referrer spam (also known as referral spam, log spam or referrer bombing) is a kind of spamdexing (spamming aimed at search engines). The technique involves making repeated web site requests using a fake referrer URL to the site the spammer wishes to advertise. Sites that publish ...


13

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...


13

However, it led me to wonder if this is considered bad practice, as the server might expose URL's the admin of the website might not want to show publicly. This suggests that the feature is implemented by checking a list of all possible valid URLs (a list the server may not even have or be easily able to get), to include non-public ones, and comparing the ...


12

You can start by submitting it to LongURL. That will usually give you the full destination URL. Then you can run it through other online tools like Web of Trust, and McAfee SiteAdvisor, to get an idea of what's there and if there are any known risks. However, your first question should be do you really trust the sender?


12

I would say that keeping a URL secret is not really the best security practise. You may have some links, whether it's hidden, or generated by Javascript, that will show the admin URL or whatever to anyone who takes a look at it. This is even more true for SPA (Single Page Application) applications I think. I don't think there is any point of hiding URLs of ...


11

Even images may contain malware, for instance a lot of embedded devices have been jail broken via vulnerabilities in libtiff. More than that, URL extensions will not always match the real file name. The value may be rewritten by HTTP headers in server response like this one: Content-Disposition: filename="myfile.exe"


11

If you look at the page source, there is a JavaScript function rwt() executed on onmousedown event. <a href="http://security.stackexchange.com/" onmousedown="return rwt(this,'','','','1','AFQjCNHano0MrEGop-Wp0eV_bNhmdh7OtQ','H4np7JuYNqsCuTIjB-78Eg','0ahUKEwjzldecwZfNAhWEVxoKHX8OAnwQFggdMAA','','',event)"> Information Security Stack Exchange</a>...


Only top voted, non community-wiki answers of a minimum length are eligible