203

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page? The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement. Rather, the displayed ...


120

Most of the link shortening providers also offer a possibility to preview the URL a short link will redirect to. Most times, it is sufficient to modify a little detail of the short link: Bitly Add a + sign to the short link (source): https://bit.ly/3kwQV20 -> https://bit.ly/3kwQV20+ Cuttly Add a @ symbol to the short link: https://cutt.ly/YEh65VC -> ...


119

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. Very few people will click on a link to https://evilphishingsite.example.com, but they might click on https://catphotos.example.com?redirect=https://...


62

If Bob is trying to type products and mistypes product, he already knows there's a URL in the website for products and so you're not telling him anything he doesn't know. If you don't suggest URLs that shouldn't be public, you won't have any issues. Why use a 404 message though, and not do an immediate redirect?


59

No, at the moment no major browsers would redirect to HTTPS automatically. The website can set HSTS header to tell browsers that they should redirect to HTTPS automatically for future requests, or they can register themselves into HSTS preload list, and users can install browser plugins to always load HTTPS based on a white list or even to always try HTTPS ...


47

Should redirect sites use HTTPS If the main site uses HTTPS then the redirect site should too. What attacks are possible if it does not Passive Attacker Can see every item looked at by the user May get extra information (which site/chat linked to the page) Active Attacker Anything a passive attacker can, and... Can MITM the connection and use ...


41

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow). Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper ...


40

I noticed that from a Google search, if I take the referer (www.google.com) out of the web request to changewise.biz, it does not redirect to the spam site. If I do not take the referer out, I get the spam site (and subsequent requests always get it since it is then cached in the browser). So I think it is not faulty old Google data, but something in your ...


31

There are actually two cases here: A site which is serving malicious ads (Malvertising) In this case the attacker does not compromise the site itself but is misusing targeted ads to select the victim based on its specific capabilities (browser, OS, geolocation,...) and attack it. Due to the way targeted ad delivery works it uses a lot of redirect between ...


31

If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users. From https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web ...


30

/test and /Test are both hosted on example.com … so it's just a page redirect not a domain redirect … this is a non-issue. People redirect like this all the time, for instance redirecting from HTTP to HTTPS is pretty much industry standard at this point.


24

I've taken a quick look, and this appears to be completely benign, if somewhat annoying. It's not an attack as Michael suggested in his answer. What has happened is that someone purchased a domain (canadaehtees.com) and pointed the DNS records for that domain at the IP address that currently hosts your website (fastslots.co). Why? It could be a simple ...


23

I would suggest that your apache process itself is backdoored, because even access to non-existing pages with something like google\. in the referer gets redirected. E.g. like GET /this-page-does-not-exist/ HTTP/1.0 Host: www.changewise.biz Referer: foobargoogle. Just search google for 'apache backdoor redirect referer' - you will find enough reports of ...


22

If your devices can connect to the internet (without redirection to Adulttube.info) through 3/4G then I suppose your router is infected with a trojan (Trojan:32/DNSChanger) https://www.f-secure.com/v-descs/dnschang.shtml Trojan :32/DNSChanger compromised the router weak default password using brute-force attacks. The Trojan then changed the routers DNS ...


18

So I just stumbled upon this today and got a similar message: https://www.linkedin.com/slink?code=eiurEkp?61778=myname First I tried the first part: https://www.linkedin.com/slink?code=eiurEkp This ends here: http://281-inteligen.thiscontentedmotion.com/de/ihel/inteligen/ - a scammy article about somebody saying that someone said that this pill will just ...


18

Implemented correctly, there are no issues with this. There are two things you should look out for (I assume that test is not static here, but user supplied, so you eg want to upper-case every path): Open Redirect: If your redirect is implemented incorrectly, it might be possible for an attacker to redirect outside of your domain, which could be used in ...


18

From my understanding the message originally tried to fool the user into clicking some seemingly expected link (as shown in the text) which in reality is a different link (href attribute in the actual link), i.e. something like <a href=http://attacker> http://example.com </a> This trick was successfully neutralized by some secure mail gateway ...


17

Since you're doing a 301 redirect over HTTP, someone could man-in-the-middle that connection and redirect you anywhere they wanted - in particular they could actually not redirect you at all, and instead get between your computer and https://login.example.com, monitoring your connection and serving you its contents under the name http://login.example.com ...


17

Unvalidated redirects do not necessarily apply here. An unvalidated redirect is something more along the lines of an attacker being able to send a victim to a destination of the attacker's choosing. If you read the example on the OWASP page you linked at the bottom, you will see that the attacker crafts a URL that can be sent to a victim using social ...


15

This is known as Referer spam, here is short description from Wikipedia: Referrer spam (also known as referral spam, log spam or referrer bombing) is a kind of spamdexing (spamming aimed at search engines). The technique involves making repeated web site requests using a fake referrer URL to the site the spammer wishes to advertise. Sites that publish ...


14

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website. So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on ...


13

However, it led me to wonder if this is considered bad practice, as the server might expose URL's the admin of the website might not want to show publicly. This suggests that the feature is implemented by checking a list of all possible valid URLs (a list the server may not even have or be easily able to get), to include non-public ones, and comparing the ...


12

I would say that keeping a URL secret is not really the best security practise. You may have some links, whether it's hidden, or generated by Javascript, that will show the admin URL or whatever to anyone who takes a look at it. This is even more true for SPA (Single Page Application) applications I think. I don't think there is any point of hiding URLs of ...


12

What risks do you have? Possibly that your computer is now infected with malicious software like a virus or a trojan horse. The following steps should be taken if you didn't already. What to do? There are some steps you can take: First of all, don't click on links that you don't trust or know Use unshortenit.it or urlex.org to check where the shortened ...


11

If you look at the page source, there is a JavaScript function rwt() executed on onmousedown event. <a href="http://security.stackexchange.com/" onmousedown="return rwt(this,'','','','1','AFQjCNHano0MrEGop-Wp0eV_bNhmdh7OtQ','H4np7JuYNqsCuTIjB-78Eg','0ahUKEwjzldecwZfNAhWEVxoKHX8OAnwQFggdMAA','','',event)"> Information Security Stack Exchange</a>...


11

What you are referring to is called a captive portal. It allows WiFi providers to authorise users, get confirmation for service agreement from them, display ads, require payment for extended usage time, etc. Its existence doesn't have security implications in itself (unless it was poorly implemented and leaking user-provided information, but that is on a ...


10

No, it's not malicious. From what I've looked into, it's rather widespread, and seen on PCs that have no indication of infection. If you open Chrome and go to chrome://settings/searchEngines, you'll see the Query URL for Google. It'll probably look like "{google:baseURL}webhp/". If it was going to a different domain, it might be worth more ...


10

The short answer No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10: A10. Unvalidated Redirects and Forwards Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to ...


9

The Majestic project is a distributed web crawler, which explains why you get such a lot of different source IP addresses. It is not malicious, that is it does not attack your site and it does not even uses lots of resources (800 requests a day is not much). Like most proper bots Majestic even includes a URL in the user-agent string and if you visit this ...


Only top voted, non community-wiki answers of a minimum length are eligible