fbpx

Learn why is URL Manipulation an IT Security Concern from Phoenix IT Consulting Firm

by | Oct 23, 2019 | MyTek Blog, Security

Q

Subscribe To The Blog

By subscribing to the blog, you will be notified when a new blog post is created on the site.

If you’ve spent any time using a computer, you probably know what a URL is. It is the address of a website. It typically starts with “http//:” or “https://” and directs the Internet browser on where the user would like to surf. Nowadays a threat could be created by manipulating the URL. Today, we’ll take you through this threat to help you understand why it is an IT security concern. 

The URL

Before we get into the manipulation of the URL, let’s define its parts. 

At the beginning of the URL there is the protocol. This tells the computing network which language is being used. For most Internet-based directions, the protocol will be HTTP, for Hypertext Transfer Protocol. Other protocols you’ll see include File Transfer Protocol (FTP), News, and Mailto.

The next part is the ID and password. Since most people don’t want their login credentials exposed, they leave this information out of the URL. Safety first. 

The next part of the URL is the server name. The server name provides users a path to access information stored on specific servers whether they are loaded through a domain or through the IP address associated with that server.

The fourth part of the URL is the port number. This number is associated with the services on the server and tells them what type of resources are being requested. The default port is port 80, which can be left off the URL as long as the information that is being requested is associated with port 80. You’ll often not see the port number during day-to-day surfing, because most legitimate sites use the standard port 80.

The final part of the URL is what is called the path. The path gives direct access to the resources found tied to the IP (or domain).

Manipulating the URL

When a hacker looks to manipulate a URL, he/she does so by changing parts of the URL to test access. Since most users navigate a website through traditional means–that is that they use the links provided on the website–sometimes hackers can find vulnerabilities by a trial and error approach. 

By manipulating the parameters to try different values, hackers can test directories and file extensions randomly to find the resources they are after. This provides access to resources that typically wouldn’t be available and would otherwise be protected. Today, hackers have tools that allow them to automate these penetrations, making it possible to test a website (and more specifically, find vulnerabilities) in seconds. With this method, these hackers can try searching for directories that make it possible to control the site, scripts that reveal information about the site, or for hidden files. 

Directory traversal attacks, also known as path traversal attacks, are also popular. This is where the hacker will modify the tree structure path in a URL to force a server to access unauthorized parts of the website. On vulnerable servers, hackers will be able to move through directories simply.

What You Can Do?

By taking IT security measures to secure your network against URL attacks, you are eliminating major vulnerability points. One thing you can do is to ensure that all of your Internet-based software is updated and patched with the latest threat definitions. In doing so you gain a lot more control over your network and data. 

MyTek offers IT security consulting services to Arizona companies to help you keep your business’ IT infrastructure from working against you. Call us today at 623-312-2440 for more information about how to maintain your organization’s network IT security.

ABOUT THE AUTHOR

Tim - Team

Tim Tiller, LMSW

 
Tim Tiller, MSW brings a deep service background to his role at Mytek, having graduated from McDonald’s management training program, fresh out of high school, and working his way up through the ranks in the hospitality industry. He has led two prior companies – Multi-Systems Inc., an IT-focused organization providing technology to hospitality companies (where he was named President at age 36), and most recently, as Chief Operating Officer for Jewish Voice Ministries International.

Q

Subscribe To This Author

By subscribing to the author, you will be notified when a new blog post is created by the author.

AUTHOR’S RECENT POSTS

Improve Your Business’ Wi-Fi and Coverage

Improve Your Business’ Wi-Fi and Coverage: Today, most businesses (and homes) depend on their Wi-Fi. It provides a lot more flexibility and value than a wired connection in many instances simply because people use a lot of wireless devices today. Today’s wireless...

Looking at Social Media Use by Company Size

Looking at Social Media Use by Company Size. Social media has turned out to be a culture-defining technology. The massive amounts of people that use the services each week, and the large amount of time people spend on these platforms, makes them important resources...

Cybercrime- It’s a Grim Picture for Businesses

Cybercrime Paints a Grim Picture for Businesses: Over the past year, entrepreneurs have focused on how to do business during the global COVID-19 pandemic. The public health crisis has been an opportunity for fraudsters and hackers, and the result has been an increase...

Mobile? Grab this Article!

QR Code

Blog Archive

Share This