As cybercrime awareness becomes more widespread, hackers have become increasingly stealthy in their attempts to gain access to private information.

For instance, URL open redirect attacks now constitute 17 percent of all malware infections; these are immensely damaging to web visitors and website owners.

In this blog post, we’ll go over what open redirect attacks are, why they’re dangerous, and what you can do to prevent them.

What is a URL open redirect attack?

Web applications often redirect users to a login page asking for credentials, to access the desired site. The destination URL is stated in a query string parameter, which is often included in the redirection procedure. Once the user has authorised the app to do so, they are directed to the URL that was previously requested.

Since the destination URL is highlighted in the query string, it can easily be altered. This altered query string could redirect users to a malicious website—this is known as an open redirect attack.

How are URL Open Redirect Attacks Dangerous?

Open redirect attacks are dangerous because users can reveal sensitive information without even knowing they have. Say, for example, a site takes you to a login page where you are asked to enter your email address and password. Once you’re done, the tampered URL will redirect you to a login page that looks similar to the one you were just on.

Here, users are asked to re-enter their details—which they do, thinking they mistyped the password the first time around. Once that’s done, the malicious website records your information and takes you to the destination site you were previously trying to access.  

This information can then be used to access your account, steal private information, and even carry out cyber theft.

How Can URL Redirect Attacks Be Prevented?

To prevent open redirect attacks, the simplest thing you can do is not let users control which site they are redirected to. However, if you still have to redirect your users, there are a few steps you can take to ensure the safety of your website and your consumers:

1.      Use a web application firewall

A WAF is the first line of defense against a variety of cyberattacks, including open redirect attacks. It also allows you to monitor traffic closely, which can indicate if a site has been tampered with.

2.      Use an automated web scanner

An automated web application vulnerability scanner reviews your site’s files and reveals any malware. It’s quick and efficient as it scans your database routinely.

3.      Update software regularly

Keep your software updated to prevent hackers from making use of outdated code. Any new patches or updates recommended by the developer should be installed immediately.

4.      Consider penetration testing

Penetration testing allows you to find out how vulnerable your website is to malicious attacks. This can help you take necessary precautionary measures so you can protect yourself in the event of a real attack.

 Choose Expert Penetration Testing Services

Lean Security is a leading penetration testing service provider with vast experience in the industry. We’ve helped thousands of big and small businesses make their websites more secure through web application security testing.

To find out how we can help you, give us a call at +61 (2) 8078 6952 or message us here.