Hot answers tagged

161

Yes, you should notify the problem to the company - with caution. Update: a shorter, very complete answer was supplied by @crovers. But if you have patience... ...the problem here is not simply the possibility of tracking J. Random Stranger, but rather that: once your ID has been given to someone, apparently you cannot take it back and it does not expire. ...


155

Summary: capability URLs are more secure than many people give them credit for, but not suitable for all applications, and require extra care to use. These type of URLs are commonly known as capability / secret URLs. It's meaningless to talk about security without specifying a threat model. Here are a couple that come to mind: 1: A passive attacker on the ...


121

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom string, assuming the server simply returns a static 404 response whenever an invalid path is specified, but there are numerous other security issues in practice ...


116

Yes. They ought to be using a long, unguessable string instead of a predictable, short one. I would consider this a security flaw that is relatively simple for them to fix. However, I would caution you - some companies do not handle situations like this very well. Some argue (in my view incorrectly) that changing that id constitutes hacking and they may ...


91

The last dash basically protects the trailing space. If you exploit SQL injection in a browser (e.g. via the URL), some browsers remove trailing space characters. Some prominent SQL flavors explicitly require the Space after Dash-Dash to treat the sequence as the start of a comment, so attackers often add a character after the Space to protect it against ...


86

In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email. Users generally don't have to type any URLs anymore since at least a few decades. In fact, if you have a look at this link, you'll see ...


83

Your question might be more undefined than you realise. Any kind of data can be passed using URL parameters. Usernames, passwords, authentication tokens, settings, form data, or anything the web developer chooses. It's not always good practice to use URL parameters to for this, but it is always possible. And it's entirely up to each individual web ...


76

Short answer: No, the URL is encrypted, but the (sub)domain is sent in plain-text. In your case a (passive) attacker knows that you are connecting to example.com, but it does not know which specific page you are accessing. In short there are three times where an attacker can get information about the site you are accessing (ordered chronological): (Sub)...


69

This particular vulnerability indeed has a name. It is called Server-Side Request Forgery (SSRF). SSRF is when a user can make a server-side application retrieve resources that were unintended by the application developer, such as other webpages on an internal network, other services that are only available when accessed from loopback (other web services and ...


43

To add to the other answers - be aware of the risks of reporting the problem yourself: If you're inexperienced with reporting security issues, you might come across to them as dodgy and potentially malicious. A company that doesn't have experience with handling security issues might forward your report to the company lawyer rather than the IT department. ...


34

This is a common approach to share public things restricted to the ones who know the URL. An example is Google Docs: The second option, "Anyone with the link", creates a link similar to yours. Same for Google Photos, Dropbox, ... The advantage is that the diffusion of the content is somewhat limited. The drawback is that this somewhat depends with whom you ...


32

Quite a bit actually: Extortion based off content Mapping systems that are not public Sensitive parameters in certain requests Personal information Extortion That search of yours that may be embarrassing and taken out of context. A WebMD search for a medical condition you don't want made known to co-workers for example. A search that was best done in ...


31

We store the URL instead of the image. In addition, this will add information and privacy risks. Let me show with a visual demo. If you try to upload any image to StackExchange, you will notice that the image gets hosted by imgur.com. The SE server fetches the images and uploads a copy of it to its private server. I will use a popular and innocent meme ...


30

Entropy is your friend. Using only alphanumeric characters (special characters are best avoided in this case because they often need URL encoding, which complicates things) you have a "language" of 62 possible characters to choose from. For a string of length X made from this "language", the total number of possible strings is simply: ...


28

Instead of uploading an image, the user can provide the (self-hosted) URL of an image. We store the URL instead of the image. You mean these kind of JPEGs? It is a bad idea. First of all, you will have to check the validity of the image every time you use it. That takes time. I assume that the database is used by other users, and you will have no control ...


27

That JavaScript executed from the address bar will run in the context of the website displayed in that tab. This means complete access to that website and it could change how the website looks and behaves from the point of view of the user. This attack is called self XSS and can cause harm to the user and indirectly to the machine. A reputable website can ...


26

Looks like you have a pretty good idea what you're doing. The one-time link pattern is pretty common for things like email verification. Typically, you'd store the expiration date in a database and/or use a signed string in the URL which includes the expiry in the string-to-sign. These are just precautions to avoid trusting user input. If you want to be ...


25

Is it better for a bank/financial service to host this sort of short link to long link translation service on their own domain and infrastructure? I think the question contains the answer. For me, the answer is a resounding yes. A URL shortener should use a domain name that is owned and controlled by the 'bank'. The stakes are too high here. In addition to ...


23

This is a serious security problem. URLs should never contain sensitive information. URLs show up in your browsing history. So even after logging out it will be trivial to access your account for anyone using the same computer. Commonly, web servers are logging incoming requests. Also, firewalls or proxies involved in processing your requests might maintain ...


23

If I were you, I would say something like Hello, I have mistyped my ID (e.g. 12345) and pressed enter instead of backspace, and I was dumbfounded to find that the page loaded and found the location of a stranger who has the ID next to mine (e.g. 12346). Being able to track someone without their permission seems to be a security problem, as someone that ...


22

It depends on how that API is meant to be used and what type of data it is accessing. Something that accesses google maps (for example) is much lower risk than something accessing banking data. Obviously a call like that in client side code is insecure, the user can easily learn your API key. If the API call is made server to server, then it's less of an ...


21

Yes. This is the reason that SslStrip works. (Okay, one of the reasons.) HTTP is in the clear. So the 301 is in the clear as well. Anyone who's listening with e.g. Wireshark will be able to see this. (Try for yourself on the same host. It's easy.)


20

Bad idea. A number of times I have seen a "secret" URL very quickly getting search engine crawler hits, and then discoverable by web search. Once I even saw someone set up a copy of a reputable website in a subfolder of his domain, share it with one person, and soon he was emailed a notice warning him that his domain may have been compromised for phishing ...


18

Browser vendors already try to protect you from homograph attacks by enforcing policies how IDNs (Internationalized Domain Names) should be displayed in the URL bar. Their measures include blacklisting potentially confusable symbols (e.g. ֊, the "Armenian hyphen" U+058A) and displaying URLs with characters from non-latin alphabets as Punycode under certain ...


16

One of the threats I'd like to mention that has not been named yet is de-anonymization. The URIs in your history could leak information about your user accounts on different sites - for instance if you constantly check your own profile on social media sites. If you use some web services anonymously and others under your real name (Facebook, Twitter) an ...


15

Yes, the ISP can see the whole URL as the request before the redirect to HTTPS is plain HTTP. HTTP Strict Transport Security (HSTS) is trying to fix that by having the server notify the browser to only connect via HTTPS. Of course, the very first request to a HSTS enabled site is still unencrypted, because the browser doesn't know about the HSTS policy of ...


15

No, the URL will not be sent in clear text. Immediately after the TCP three-way handshake completes, your client initiates TLS negotiation with the server. Only after that negotiation is complete and encryption is in place is the HTTP request sent.


15

TL;DR An attacker cannot see anything past the domain. Structure of a HTTP request HTTP works by sending two things to a website: the method, and the headers. The most common methods are GET, POST, and HEAD, which retrieves a page, transfers data, or requests only response headers, respectively. TLS encrypts the entirety of HTTP traffic, including the ...


14

In addition to the other answers, I would like to stress that communications from a financial shall be easily verifiable for the user. Say a customer receives a sms/email: YOURBANK: Your purchase has been successful. More info https://bit.ly/2VBP5iK Is this legitimate or not? Even if the to their IT team, that url itself provides no context, requiring ...


13

SQL injection: how to find urls weak to SQL Injection attacks. First, you have to understand the different types of SQLi, here. I will speak here about In-band Injection, the classic one. divided into 2 types: Error based SQLi UNION based SQLi Error Based SQLI Goal: Gathering database structure information by Displaying SQL Errors on the target website. ...


Only top voted, non community-wiki answers of a minimum length are eligible