By clicking on links inside an email you're actually doing a HTTP GET request. Probably before sending this phishing mail to you they (who create phoshing sites) automatically added some identifier to that link to be able to check later who got an email and who clicked on that link, when and from which IP and from which browser, etc. So they can identify you....
Question 1: Are in this case WooCommerce, my website’s host, third
party security, backup and other plugin providers considered as
service providers in case I use URL redirection method or iFrame for
payments? Meaning that they should be PCI DSS validated? Or does that
apply only to the payment processor/gateway as others are not involved
Remember that crime is now commoditised and supported by a large framework of services. Any single email you receive might be part of a dozen different criminal services.
So, what is happening exactly here is not going to be known without access to the services used. We can only speculate.
The first hop is the easiest to guess. SOME_LETTERS_AND_NUMBERS is ...
This practice of resuming the original request after authentication is sometimes called "bookmarking," because it allows users to bookmark specific parts of a site and "go there" by way of the login process.
When bookmarking isn't available, it's usually a sign that the site wasn't designed or architected to allow it. For example, if authentication is ...
Is there any sort of security reason for this, or is it just lazy
programming, or something else?
There is no security reason to it as long as the website doesn't take user input and then redirect them there without any input validation.
The only thing i can see here is just poor design.I mean the customer was already interested in a product instead of ...
No, it is no Denial of Service vulnerability. Even if a single browser were to constantly request resources from your server, it would likely not go down.
A Denial-of-Service attack can have multiple reasons:
A vulnerability that causes the server to crash.
For example, an attacker can cause the server to read /dev/zero. As the file is of infinite length, ...
No, it can't. Even if you were to make an infinite loop, browsers will quickly give up following it, and show a message like this (this one in particular is from Firefox):
The page isn’t redirecting properly
Firefox has detected that the server is redirecting the request for
this address in a way that will never complete. This problem can