Sublime Security medium experimental mql

Open redirect: MSN

Message uses an MSN open redirect. Sample (benign) redirect to sublimesecurity[.]com: https[:]//www[.]msn[.]com/en-gb/lifestyle/rf-best-products-uk/redirect?url=aHR0cHM6Ly93d3cuc3VibGltZXNlY3VyaXR5LmNvbQ==

View Source

Detection Logic

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "msn.com"
        and .href_url.path =~ "/en-gb/lifestyle/rf-best-products-uk/redirect"
        and strings.icontains(.href_url.query_params, "url")
)

Field Validations

Loading…

Comments (0)

Loading comments...