A10 - Unvalidated Redirects and Forwards

A10 - Unvalidated
Redirects and
Forwards
IT 6873 Presentation
By William Stanley
Southern Polytechnic State University
Fall 2014

What is a unvalidated redirect?
 Definitions
 OWASP: The linking to a destination with out proper validation
that leads to unauthorized pages.
 Google: References unvalidated redirects as simply spammy and
or malware.
 Microsoft: Any web application that redirects to a URL that is
specified via the request such as the querystring or form data can
potentially be tampered with to redirect users to an external,
malicious URL
Summary: An unvalidated redirect is link on trusted site that will
take the user to an unauthorized site to expose a vulnerability by
either installing malicious software or by gaining secure information
from the user.

Why use redirects?
 Similar domain names: to redirect for misspellings
 Moving pages: merge sites, move to a new domain, or name
change
 Logging out going link: A technique that was made popular by
selling ads on sites direct them to sites such as Amazon.com
 Shortening the original link: links on sites with hundreds and
thousands of pages typically do this for a shorter link.
 Manipulating
 One way to make sure search engines and visitors reach the correct
site
 Another way to make sure search engines and visitors reach the
wrong site, also considered phishing.

Example: unvalidated redirect
 Code in yellow redirects user to a different site

Example: unvalidated redirect
 Unvalidated redirects also can be in emails

Risks of unvalidated redirects
 Typical reasons unvalidated redirects are used
 To direct a user to a site in order to obtain username and password to
sites. Examples: ebay.com, paypal.com, amazon.com, etc…
 Used to access information in order to obtain products and goods with
information provided by the end user
 Used to direct an end user to a site that sells services
 Examples: adult content, prescription companies in to other countries,
start up sites competing for business….
 Unvalidated redirects used to steal infromation
 This is done when a user goes to a site that may look the same as the
intended site but created for the purpose of stealing information.
 Username and passwords as previously mentioned
 Reading cookies together information

 Installing malicious code
 Can be done by clicking on a file to download such as pdf’s
 Can also be done by having buttons or images to return to previous page. When the
user clicks on the image thinking they are returning to the previous site they are
actually acknowledge a software download. The code gathers information and send
to the intruder and or hacker.
 Misdirection unvalidated redirects
 Typically uses:
 Email called phishing
 Email comes from trusted site but disguised, example would be from Internal
Revenue Service.
 This type of redirect tries to use misdirection by obtaining the user attention
to an important matter, while getting them to click on the that takes them to
the redirect to gather secure information.

 One of the biggest risks of unvalidated redirects to business is
the cost.
 What happens when customers get unvalidated redirects:
 Customer loose trust in the site
 Customer can loose personnel information
 Security breach if the program gathers enough information
 Cost to clear the matter up can be costly including but not limited to
closing the business due to the cost.

Ways to detect unvalidated redirects
 The easiest way to detect an unvlalidated redirect is to hover
over the link with the mouse.
 By placing the mouse over the link the user can see where the link is
headed
 The user can compare the redirect link with the intended site link and
see if it matches.
 Other ways to detect unvalidated links
 Google offers the option to use site:search
 The site administrator simply types the website address in the googles
search engine and goes through the webpages to see all of the links.
 The site administrator compare all the links to what should be expected and if
something appears incorrectly they correct the code
 Example a hardware store enters their site into Google's search engine: John
Doe’s Hardware.
 If the administrator notice a Viagra related page then the site has an
unvalidated redirect.
 Google even offers a Google alert to automate the searh

Ways to detect unvalidated redirects
 Most of today’s and even older applications used to create
websites can check for valid redirects.
 Microsoft’s FrontPage for example had an option to check all links in
the website and validate the end result. The screen was shown in
table format to compare the links to the redirects to make sure they
were valid.
 Today’s browser have also got a lot better at searching ahead
before taking the user to the page.
 If you use Mozilla Firefox you may have seen the following screen
shot because the webpage did not match in the information given:

How to prevent unvalidated redirects
 Simple avoid using redirects in your website.
 If they can not be avoided, do not use parameters to calculate the
destination.
 This means to give the direct site location.
 If none of this can be avoided, make sure the server side
application is used for translation.

Summary
 While it is very easy to create a unvalidated redirect it is also
simple to find.
 Most unvalidated redirects use the magicians trick of while the
eyes are watching one hand the other is doing something else.
 It is also easy to correct coding for unvalidated redirect.
 The most effective items a website administrator can do to
prevent unvalidated redirects:
 Use good coding practices
 Audit the site periodically
 The most effective items a user can to prevent unvalidated
redirects:
 Use internet security software
 Keep their browser up to date
 Pay attention to URL’s look before click.

References
 Application Security: The Essentials – Unvalidated Redirects and
Forwards: http://www.labs64.com/blog/2014/01/application-security-the-
essentials-unvalidated-redirects-and-forwards/
 OWASP: https://www.owasp.org/index.php/Top_10_2013-A10-
Unvalidated_Redirects_and_Forwards
 Open redirect URLS: Is your site being abused?
http://googlewebmastercentral.blogspot.com/2009/01/open-redirect-urls-
is-your-site-being.html
 Preventing Open Redirect Attacks(C#):
http://www.asp.net/mvc/overview/security/preventing-open-redirection-attacks
 Security testing and for unvalidated redirects and forwards:
http://searchsoftwarequality.techtarget.com/tip/Security-testing-for-unvalidated-
redirects-and-forwards
 URL redirection: http://en.wikipedia.org/wiki/URL_redirection
 URL Redirector Abuse:
http://projects.webappsec.org/w/page/13246981/URL%20Redirector%2
0Abuse
 Wikipedia, URL redirection: http://en.wikipedia.org/wiki/URL_redirection

References
 Module 10: Unvalidated Redirects and Forwards:
http://www.securingthehuman.org/programs/government-current/
video/unvalidated-redirects-and-forwards
 Hacking Websites – Part 6: Unvalidated Redirects and
Forwards:
http://www.thatcoderguy.co.uk/2014/09/16/hacking-websites-part-
6-unvalidated-redirects-and-forwards/

A10 - Unvalidated Redirects and Forwards

More Related Content

What's hot

Viewers also liked

Similar to A10 - Unvalidated Redirects and Forwards

Recently uploaded

In this document

A10 - Unvalidated Redirects and Forwards