Which vulnerability enables attackers to install malware or trick victims into disclosing passwords, often via unsafe redirects or forwards that bypass access controls?

Which vulnerability enables attackers to install malware or trick victims into disclosing passwords, often via unsafe redirects or forwards that bypass access controls?

• A. Cookie poisoning attack
• B. Web Service Attack
• C. Unvalidated Redirects and Forwards
• D. Cookie Snooping

Answer: (C)

Unvalidated Redirects and Forwards involve a web application taking a destination URL from user input and redirecting or forwarding the user to that URL without proper validation. Attackers exploit this by crafting links that appear to come from a trusted site but actually point to attacker-controlled sites, where malware can be delivered or users can be tricked into entering passwords on a phishing page. Because the redirect can happen after the user has trusted the original site, it can bypass some access checks and move the user to a page or domain where credentials are collected or malware is served. The other options describe different issues—tampering with cookies to alter sessions, broad web service vulnerabilities, or intercepting cookies—to do not involve unsafe redirects or forwards, so they don’t match this scenario.

Unvalidated Redirects and Forwards involve a web application taking a destination URL from user input and redirecting or forwarding the user to that URL without proper validation. Attackers exploit this by crafting links that appear to come from a trusted site but actually point to attacker-controlled sites, where malware can be delivered or users can be tricked into entering passwords on a phishing page. Because the redirect can happen after the user has trusted the original site, it can bypass some access checks and move the user to a page or domain where credentials are collected or malware is served. The other options describe different issues—tampering with cookies to alter sessions, broad web service vulnerabilities, or intercepting cookies—to do not involve unsafe redirects or forwards, so they don’t match this scenario.