From bcbba879165747c7e2975888cb25668840cf6525 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=B0smail=20Ta=C5=9Fdelen?= Date: Fri, 10 Jan 2020 08:20:50 +0300 Subject: [PATCH] Update README.md --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index 65be1a2..8025b37 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,9 @@ ### Open Redirect Payload List +

+ +

+ Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts may have a more trustworthy appearance. Unvalidated redirect and forward attacks can also be used to maliciously craft a URL that would pass the application’s access control check and then forward the attacker to privileged functions that they would normally not be able to access.