但是有个安全网站的某个地址只做重定向，而且不进行任何内部判断（或者说是安全判断），那么只要将不安全网站作为其参数，就可以绕开钓鱼网站判定机制。如：
浏览该地址，的确会在安全网站上做一次操作，但是将完成一个重定向动作，重定向结果将是不安全网站。
这样的情况会发生在登录的情况，有的登录界面会有一个ReturnUrl作为参数标识。
按照正常的流程，将会在登录成功后跳转到default.aspx页面，但是如果将这里写为重定向到一个伪安全页面，如：
那么在登录后，将会见到一个非安全的页面，而这时候用户通常难以察觉或者已经中招。（病毒/钓鱼/骗流量等）
总结
在站点中通过URL参数做重定向，将直接给非法网站提供机会。
<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="WebAppUnsafeRedirect._Default" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
<title>Unsafe Redirect</title>
</head>
<script runat="server">
private void btnLogin_Click(object sender, EventArgs e)
{
if (CheckUser(txtUsername.Text, txtPassword.Text))
{
string redirectUrl = Request.QueryString["ReturnUrl"] ?? "http://volnet.cnblogs.com?key=demo-unsafe-redirect";
Response.Redirect(redirectUrl);
}
}
</script>
<body>
<form id="form1" runat="server">
<div>
<asp:TextBox ID="txtUsername" runat="server"></asp:TextBox><br />
<asp:TextBox ID="txtPassword" runat="server" TextMode="Password"></asp:TextBox><br />
<asp:Button ID="btnLogin" runat="server" Text="Login"
onclick="btnLogin_Click" /><br />
</div>
</form>
</body>
<script runat="server">
private bool CheckUser(string userName, string password)
{
if (userName == "User1" && password == "Password")
{
return true;
}
return false;
}
</script>
</html>
原文链接：https://www.cnblogs.com/volnet/archive/2009/07/29/unsafe-redirect.html
原创文章，作者：优速盾-小U，如若转载，请注明出处：https://www.cdnb.net/bbs/archives/17712
评论列表（3条）
I believe what you posted was very logical. However, what about this?
what if you were to write a killer post title?
I mean, I don’t wish to tell you how to run your website, but suppose you added a title to
possibly grab people’s attention? I mean [网站安全]避免在站点中通过URL参数做重定向
– 优速盾 is kinda vanilla. You might glance at Yahoo’s home page and note
how they create news headlines to grab people to click.
You might add a related video or a related pic or two to get people excited about what you’ve got to say.
In my opinion, it might make your website a little
bit more interesting.
Deneme bonusu veren ve en iyi deyeye boyuyu veyen siyeyer bahis siteleri burada. Güvenilir sitelerle bonuslarınızı hemen alın, Yeni Üyelere deneme bonusu fırsatını kaçırmayın
itsallgoodbakery adult hreflang en iyi deneme bonusu veren pornocu sahibidir.