From 9ae3f0455187713be345e59a88e097fec2ce7113 Mon Sep 17 00:00:00 2001 From: Ben Jones Date: Sun, 17 Nov 2024 15:53:38 +1100 Subject: [PATCH] update README.md --- .../README.md | 12 ++++++------ README.md | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) rename .student_resources/{invalid_forward_and_redirect => invalid_forwards_and_redirects}/README.md (83%) diff --git a/.student_resources/invalid_forward_and_redirect/README.md b/.student_resources/invalid_forwards_and_redirects/README.md similarity index 83% rename from .student_resources/invalid_forward_and_redirect/README.md rename to .student_resources/invalid_forwards_and_redirects/README.md index 79fceed..527fdee 100644 --- a/.student_resources/invalid_forward_and_redirect/README.md +++ b/.student_resources/invalid_forwards_and_redirects/README.md @@ -1,21 +1,21 @@ -# Invalid Forward and Redirect +# Invalid Forwards and Redirects Invalid (or unvalidated) forwards and redirects are a form of user-controlled input in which a web application accepts untrusted input that could cause the web application to redirect. Because the domain name in the modified link is identical to the trusted domain name, phishing attempts may appear more trustworthy. This vulnerability is often combined with a CSRF, man in the middle or website spoofing as a more complex threat vector. ```HTTP -https://www.trustedwebsite.com/examples/example.php?url=http://malicious.com +https://www.trustedwebsite.com/examples/example.php?url=http://www.malicious.com ``` -| Protocol | subdomain | domain | path | endpoint | parameters | -| -------- | --------- | ------------------ | -------- | ------------ | ------------------------ | -| https | www | trustedwebsite.com | examples | example.html | url=http://malicious.com | +| Protocol | subdomain | domain | path | endpoint | parameters | +| -------- | --------- | ------------------ | -------- | ------------ | ---------------------------- | +| https | www | trustedwebsite.com | examples | example.html | url=http://www.malicious.com | ## How to penetrate test for this vulnerability 1. Look for forms collecting URLs that are rendered on the front end. Enter a malicious URL and see if it validates and renders. -2. Look for frontend URL, path, or endpoint parameter passing, construct a URL to an untrusted domain, and test whether the site redirects. +2. Look for frontend URL, path, or endpoint parameter passing, construct a URL to an untrusted domain, and test whether the site redirects. `https://127.0.0.1:5000?url=http://www.malicious.com` ## How to countermeasure this vulnerability diff --git a/README.md b/README.md index 7cfbdc7..d99db3d 100644 --- a/README.md +++ b/README.md @@ -114,7 +114,7 @@ To support students first understanding specific security vulnerabilities and pr - [Encrypting passwords](.student_resources/encrypting_passwords/README.md). - [Exception management](.student_resources/defensive_data_handling/README.md#exception-handling). - [Defensive data handling](.student_resources/defensive_data_handling/README.md). -- [Invalid forward and redirect](.student_resources/invalid_forward_and_redirect/README.md). +- [Invalid forwards and redirects](.student_resources/invalid_forwards_and_redirects/README.md). - [Race conditions](.student_resources/race_conditions). - [Secure input form attributes](.student_resources/secure_form_attributes/README.md). - [SQL injection](.student_resources/SQL_Injection/README.md).