Invalid URI Redirection with Apache mod_rewrite Logo

Invalid URI Redirection with Apache mod_rewrite

0
Free
Visit Website

There have been times when a curious phish recipient or a zealous help desk staff has loaded the phishing link in their browser and decided to take a peek at a higher directory or the root domain. Of course, most times there isn’t much else site to see. In those cases, the chances of being reported to IR went up significantly, sometimes leading to a phishing campaign being blocked. This is where invalid URI redirection comes in handy. We can whitelist resources the Apache server will proxy for the targets and redirect any other requests to the target’s real domain or another page of our choosing. In the demo below, the user navigates to spoofdomain.com/really/long/url.html and is served a page; however, when the user navigates to spoofdomain.com/really/ the browser is redirected to google.com. RewriteEngine On RewriteCond %{REQUEST_URI} ^/(profiler|payload)/?$ [NC,OR] RewriteCond %{HTTP_REFERER} ^http://SPOOFED-DOMAIN.com [NC] RewriteRule ^.*$ http://TEAMSERVER-IP%{REQUEST_URI} [P] RewriteRule ^.*$ http://REDIRECTION-URL.com/? [L,R=302] Line by line explanation: Enable the rewrite engine If the request's URI is either '/profiler' or '/payload' (with an optional trailing slash), ignoring case; OR If the request's referer starts with 'http://SPOOFED-DOMAIN.com', ignoring case;

FEATURES

ALTERNATIVES

A developer-first, API-driven platform that provides development teams with a suite of tools to improve code quality, security, and engineering performance, seamlessly integrated into their existing development workflows.

A web-based tool for instrumenting and analyzing Android applications using Flask, Jinja, and Redis.

An API security platform that provides automated security testing, runtime protection, and lifecycle management for APIs through integrated tools and controls.

EvoMaster is an open-source tool that automatically generates system-level test cases for web APIs using AI-driven techniques.

A vulnerable by design infrastructure on Azure featuring the latest released OWASP Top 10 web application security risks (2021) and other misconfigurations.

An API security platform that provides automated discovery, documentation, and continuous security testing throughout the API lifecycle.

WordPress plugin to reduce comment spam with a smarter honeypot.

Checkmarx One SAST is a static application security testing tool that combines speed and security to improve developer experience.

PINNED