Multiple choice › Invalid forwarding and redirecting
Invalid forwarding and redirecting
1. Invalid forwarding and redirecting
A site redirects users to whatever address is in the URL parameter 'next', without checking it. What is the risk?
- Users can be sent to a malicious site that looks legitimate
- The user's password will be hashed twice
- The site will load more slowly
- The database will become corrupted
Answer
A
Unvalidated redirects/forwards let attackers craft links on a trusted domain that bounce victims to a phishing site. Validate against an allow-list.