Malicious Redirects - secuguru/security-terms GitHub Wiki

Malicious redirects are a type of cyberattack where users are forcibly redirected from a legitimate website to a malicious one. These redirections are often employed to deliver malware, steal credentials, engage in phishing, or generate fraudulent ad revenue.

Malicious redirects exploit vulnerabilities in websites, browsers, or plugins to forcibly reroute users to harmful destinations. These redirections can occur in multiple layers, including:

1. Server-Side Redirects:

• Compromised servers are configured to redirect incoming traffic to malicious URLs.

2. Client-Side Redirects:

• Scripts injected into a website’s frontend (e.g., JavaScript) redirect users.
• Example:

window.location = "http://malicious-site.com";

3. Man-in-the-Middle (MITM):

• Attackers intercept traffic and inject malicious redirects.

4. Malicious Ads (Malvertising):

• Fake ads displayed on legitimate websites redirect users to malicious sites.

• Attackers inject malicious scripts into a vulnerable website.
• Example:

<script>
  window.location.href = "http://malicious-site.com";
</script>

• Vulnerabilities like XSS (Cross-Site Scripting) enable attackers to insert redirection scripts.

• In Apache servers, attackers modify the .htaccess file to redirect traffic.
• Example:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*$
RewriteRule ^.*$ http://malicious-site.com [R=301,L]

• URLs are crafted with malicious parameters to trigger redirects.
• Example:

http://example.com/?redirect=http://malicious-site.com

• Exploiting outdated browsers or plugins to force redirects.

• Attackers modify DNS records to redirect legitimate domain traffic to malicious servers.

1. Deliver Malware:

• Redirect users to sites hosting malicious payloads (e.g., ransomware, spyware).

2. Phishing:

• Send users to fake login pages to steal credentials.
• Example:

http://bank-login-example.com

3. Ad Fraud:

• Redirect traffic to fraudulent ad networks to generate revenue.

4. Traffic Redirection:

• Divert traffic to competitor websites or black-hat SEO pages.

5. Credential Theft:

• Steal sensitive information like passwords, credit card numbers, or personal details.

1. Unexpected Behavior:

• Clicking legitimate links results in redirection to unrelated websites.

2. Multiple Redirects:

• Users are redirected through multiple domains before reaching the final malicious destination.

3. Pop-Ups and Ads:

• A sudden increase in pop-ups or unauthorized ads.

4. Changes in .htaccess:

• Unintended modifications to .htaccess files in website directories.

5. Suspicious Query Parameters:

• URLs containing redirect, next, or url parameters leading to external domains.

1. Burp Suite:

• Monitor HTTP responses for unexpected redirects.

2. OWASP ZAP:

• Scan for scripts and headers that initiate redirections.

3. Google Search Console:

• Check for security warnings or flagged redirects on your website.

4. Website Monitoring Tools:

• Tools like Sucuri and SiteLock monitor for malicious scripts and .htaccess changes.

5. Browser Developer Tools:

• Inspect network activity and JavaScript for unauthorized redirects.

1. Sanitize and Validate Input:

• Prevent attackers from injecting scripts or redirect parameters.
• Example (PHP):

$url = filter_var($_GET['url'], FILTER_VALIDATE_URL);
if (!$url || !in_array(parse_url($url, PHP_URL_HOST), $allowed_domains)) {
    die("Invalid redirect URL");
}

2. Secure .htaccess Files:

• Restrict access and monitor for unauthorized changes.

3. Content Security Policy (CSP):

• Prevent unauthorized scripts from executing redirects:

Content-Security-Policy: default-src 'self'; script-src 'self'

4. Regular Updates:

• Keep software, plugins, and libraries updated to patch vulnerabilities.

5. Use HTTPS Everywhere:

• Prevent MITM attacks that could inject malicious redirects.

6. Employ a Web Application Firewall (WAF):

• Block suspicious traffic and payloads attempting to initiate redirects.

7. Monitor Server Logs:

• Look for unusual patterns indicating redirect activity.

8. Remove Malicious Ads:

• Use ad blockers or configure your site to block third-party scripts.

• Attackers exploited a WordPress vulnerability to modify .htaccess files.
• Redirected users to:

http://malicious-ads-site.com

• Result:
  • Users were exposed to malvertising and phishing attempts.

• Regularly update WordPress and plugins.
• Restrict access to .htaccess files.

Malicious redirects pose significant risks to users and organizations, enabling attackers to deliver malware, steal credentials, and generate fraudulent revenue. Implementing robust security measures like input validation, securing .htaccess files, deploying CSP headers, and using WAFs can effectively mitigate the threat of malicious redirects. Regular monitoring and updates are crucial for maintaining security.