Security Testing Tutorial
Security Testing Useful Resources
Selected Reading
- Security Testing - Automation Tools
- Testing Malicious File Execution
- Security Testing - Denial of Service
- Security Testing - Buffer Overflows
- Testing Security - Web Service
- Security Testing - Ajax Security
- Unvalidated Redirects and Forwards
- Components with Vulnerabilities
- Cross Site Request Forgery
- Missing Function Level Access Control
- Testing Sensitive Data Exposure
- Testing Security Misconfiguration
- Insecure Direct Object Reference
- Testing Cross Site Scripting
- Testing Broken Authentication
- Security Testing - Injection
- Hacking Web Applications
- Security Testing - Cookies
- Security Testing - Same Origin Policy
- Security Testing - Cryptography
- Encoding and Decoding
- HTTPS Protocol Basics
- HTTP Protocol Basics
- Security Testing - Malicious Software
- Security Testing - Process
- Security Testing - Overview
- Security Testing - Home
Security Testing Useful Resources
Selected Reading
- Who is Who
- Computer Glossary
- HR Interview Questions
- Effective Resume Writing
- Questions and Answers
- UPSC IAS Exams Notes
Unvalidated Redirects and Forwards
Unvapdated Redirects and Forwards
互联网上的大多数网络应用经常向其他网页或其他外部网站转播用户,并转播用户。 然而,在不证实这些网页的可信性的情况下,黑客可以将受害者转向营养化或mal磨点,或使用未经许可的网页。
让我们在简单图表的帮助下理解这一缺陷的威胁代理人、攻击者、安全弱点、技术影响和商业影响。
Example
某些未经验证的转子和前线的典型例子如下:
让我们说,申请有一页,即直线,直线。 该黑客还增加了一种恶毒的URL,把那些从事养成/装饰的用户转往。
http://www.mywebapp.com/redirect.jsp?redirectrul=hacker.com
所有网络应用都用于向网站的不同部分传送用户。 为了达到同样的目的,有些网页使用一个参数,以表明如果业务成功,用户应当重新定位。 袭击者手工艺了一辆载有申请出入控制检查的URL飞机,然后将袭击者转至攻击者无法进入的行政功能。
http://www.mywebapp.com/checkstatus.jsp?fwd=appadmin.jsp
Preventive Mechanisms
最好避免使用转头和转头。
如果是不可避免的,那么就应当在不涉及用户参数的情况下调整目的地。