Collaborate Disseminate
Open redirects showed up in the news this week thanks to Microsoft. While this is very old issue, this is a new topic for me. The concern seems to be that a user hovering over a link may not read beyond the domain name. In the following… Continue reading Open Redirects – Can they be done without modifying server side code?
I found a stored xss vulnerability on a comment section of a fun site and I wanted to steal cookies using xss attack.
So on my remote server I run an HTTP server with Flask using python where there is a script to steal the document.cookie … Continue reading Stored XSS cookie stealing, but a loop of redirection
I am pentesting an API which makes a backend call to https://example.org/ and appends any input you provide it (for example, if you provide test it will call https://example.org/test). I am trying to achieve SSRF in this scenario, so my go… Continue reading Hijacking URL that ends with a trailing slash
On my company’s computer, someone play the internet game so I want to deny the site and redirect to another site.
Or If someone access the game site redirect to other site right off on computer sestimg
I know there are some questions around open redirects but with this one I have some additional questions. In order to not release the assets I am going to replace the asset with "exampleeee.com".
There is a vulnerable parameter r… Continue reading Open redirect adding symbol
History
I’ve worked on a website that had kind of an open redirect by design. It was explicitly used to send users to an external destination. It had a long paragraph stating that the following Link is an external destination we have no co… Continue reading Open redirect exploit I don’t understand – what is it used for?
When I go to https://www.google.com/chrome/, I get redirected to sign in and then forwarded to some app engine link as can be seen in the continue parameter of the following URL:
https[:]//accounts[.]google[.]com/ServiceLogin/webreauth?ser… Continue reading Unusual Google Chrome Download Redirection
I am testing a bug bounty website, and found an endpoint like www.example.com/infinite. When open it, it keep doing 302 redirect to itself until browser stops it for redirecting too many times.
For example:
www.example.com/infinite ==>… Continue reading Does an url that redirecting infinitely have any impact to website?
I talk in a security forum, and sometimes a moderator share links to sources about things he talk about, but when I hover on these links, the link is different the the source it self. It is actually a URL shortener that he himself built wh… Continue reading URL shortener who does nothing according to the owner [closed]
We have done vulnerability analysis with third party security team. They have mentioned one point as critical findings but i don’t understand risk associated with it and suggested remedial action also bit confusing.
Finding : Same web appl… Continue reading What are the risks associate with accessing Same web application with two different URLs?