35 lines
2.3 KiB
Markdown
35 lines
2.3 KiB
Markdown
---
|
|
title: "Semantic URL attack"
|
|
chunk: 1/1
|
|
source: "https://en.wikipedia.org/wiki/Semantic_URL_attack"
|
|
category: "reference"
|
|
tags: "science, encyclopedia"
|
|
date_saved: "2026-05-05T11:38:46.009149+00:00"
|
|
instance: "kb-cron"
|
|
---
|
|
|
|
In a semantic URL attack, a client manually adjusts the parameters of its request by maintaining the URL's syntax but altering its semantic meaning. This attack is primarily used against CGI driven websites.
|
|
A similar attack involving web browser cookies is commonly referred to as cookie poisoning.
|
|
|
|
|
|
== Example ==
|
|
Consider a web-based e-mail application where users can reset their password by answering the security question correctly, and allows the users to send the password
|
|
to the e-mail address of their choosing. After they answer the security question correctly, the web page will arrive to the following web form where the users can enter their alternative e-mail address:
|
|
|
|
The receiving page, resetpassword.php, has all the information it needs to send the password to the new e-mail. The hidden variable username contains the value user001, which is the username of the e-mail account.
|
|
Because this web form is using the GET data method, when the user submits alternative@emailexample.com as the e-mail address where the user wants the password to be sent to,
|
|
the user then arrives at the following URL:
|
|
|
|
http://semanticurlattackexample.com/resetpassword.php?username=user001&altemail=alternative%40emailexample.com
|
|
This URL appears in the location bar of the browser, so the user can identify the username and the e-mail address through the URL parameters. The user may decide to steal other people's (user002) e-mail address by visiting the following URL as an experiment:
|
|
|
|
http://semanticurlattackexample.com/resetpassword.php?username=user002&altemail=alternative%40emailexample.com
|
|
If resetpassword.php accepts these values, it is vulnerable to a semantic URL attack. The new password of user002's e-mail address will be generated and sent to alternative@emailexample.com which causes user002's e-mail account to be stolen.
|
|
One method of avoiding semantic URL attacks is by using session variables. However, session variables can be vulnerable to other types of attacks such as session hijacking and cross-site scripting.
|
|
|
|
|
|
== References ==
|
|
|
|
|
|
== See also ==
|
|
Query string |