Collaborate Disseminate
Maybe my math is wrong, but here it goes.
If I generate a private url to share an album in Google Photos, I get something like this
https://photos.app.goo.gl/*****************
where the asterisks are alphanumeric characters, case sensitive… Continue reading Are the private URLs from Google Photos actually unguessable?
I received this url:
https://example.com?default=1&p=1&fbclid=IwAR0c_yC3pVrJDVChtK8cxxFOP_qAg8xwKp7YLC3RWCKCHMaLjiNNo64d95c
But the url without the parameter still goto the same page, i.e.:
https://example.com
So I suspect that s… Continue reading What are these parameters in this url for? Are they harmful? [closed]
This year, Google is notifying users that shared links to their shared Google drive files will change:
https://support.google.com/a/answer/10685032?hl=en
The announcement begins:
To make file sharing more secure, an upcoming security upda… Continue reading Were Google’s old link-sharing links not cryptographically random?
I recently looked at a spam mail I received. Generally, I’d say it was a fairly standard phishing attempt, but one thing struck me as odd:
The link that victims are supposed to click looks very weird and (apart from the domain name) consis… Continue reading Why are there so many special characters in this phishing link?
Apparently Google indexes hashbang URLs: https://www.youtube.com/watch?v=kDs-MufuiAg
Can an attacker link to another website with fictitious hashbang-URLs and use it to hurt that website (if the victim’s website does not specify a canonica… Continue reading Can hashbang (#!) URLs be used to SEO attack a website?
I have numeric IDs that I would like to use in filenames. So for example with IDs 1, 2, 3 we would have 1.jpg, 2.jpg, and 3.jpg
Now the problem is that clearly a user could just guess 4.jpg and view something they shouldn’t be able to find… Continue reading Keyed Hash Function (HMAC) For Unguessable URLs?
I’m using JWTs as part of an URL in order to direct a user to a specific site. I could have just used a UUID, but it’s nice to have an expiry date in the link, as well as knowing whom the link is created for.
This has been working great, b… Continue reading Can a JWT be all lowercase?
Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows.
The request URL which our application intended to accept is www.host.com/… Continue reading Some random string is appended prefixed by a DOT at the end of URL
We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn’t allow any executable content. All the CSS is put through a whitelist par… Continue reading Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?
Suppose there is a file hosting server, and most filenames are strings with mostly CJK characters. Transmitting those characters in HTTP GET requests requires encoding them using UTF-8 (x3 overhead) then URL-encode escaping (another x3 ove… Continue reading Additional verification, sanitization for CJK paths in URLs