Ethical Hacker’s Guide: Understanding URLs vs URIs and Fragments

By /

Listen to this Post

Featured Image

Introduction

In cybersecurity, particularly penetration testing, understanding the nuances between URLs (Uniform Resource Locators) and URIs (Uniform Resource Identifiers) is critical. A URL specifies the location of a resource, while a URI identifies it, often including additional parameters like fragments or query strings. Misinterpreting these can lead to vulnerabilities in web applications or flawed security assessments.

Learning Objectives

  • Differentiate between URLs and URIs in web security contexts.
  • Utilize URL fragments (“) for client-side exploitation or testing.
  • Identify security risks associated with improperly parsed URIs.

You Should Know

1. URL vs. URI Structure

Command/Code Snippet:

URL: https://example.com/path/index.html 
URI: https://example.com/path/index.html?user=adminsection1

Step-by-Step Guide:

  • A URL includes:
  • Protocol (`https://`)
  • Domain (example.com)
  • Path (/path/index.html)
  • A URI extends this with:
  • Query parameters (?user=admin)
  • Fragments (section1)
    Use Case: Pentesters must parse URIs to test for injection vulnerabilities (e.g., ?id=1 AND 1=1--).

2. Exploiting URL Fragments

Code Snippet:


<div id="secretToken">Sensitive Data</div>

Step-by-Step Guide:

  1. Craft a URL with a fragment: `https://victim.com/profilesecretToken`.
  2. If the page dynamically loads content based on fragments, attackers may extract hidden data.
  3. Mitigation: Sanitize client-side rendering (e.g., React/Vue.js) to ignore malicious fragments.

3. Testing URI Parameter Injection

Command:

curl -X GET "https://api.example.com/users?id=1' OR '1'='1"

Step-by-Step Guide:

  • Send malformed query parameters to test SQL injection.
  • Observe responses for errors or unexpected data leaks.
  • Secure APIs by validating input (e.g., regex filters).

4. Extracting Metadata from URIs

Command:

python3 -c "from urllib.parse import urlparse; print(urlparse('https://example.com/path?key=valuefrag'))"

Output:

ParseResult(scheme='https', netloc='example.com', path='/path', params='', query='key=value', fragment='frag')

Use Case: Automate URI parsing in scripts to identify attack surfaces.

5. Cloud Hardening: Block Malicious URIs

AWS WAF Rule Snippet:

{ 
"Name": "BlockSQLi", 
"Priority": 1, 
"Action": { "Block": {} }, 
"VisibilityConfig": { 
"SampledRequestsEnabled": true, 
"CloudWatchMetricsEnabled": true 
}, 
"Statement": { 
"SqlInjectionMatchStatement": { 
"FieldToMatch": { "QueryString": {} }, 
"TextTransformations": [ { "Type": "URL_DECODE", "Priority": 0 } ] 
} 
} 
}

Step-by-Step Guide:

  1. Deploy this rule to block SQLi attempts in query strings.

2. Monitor CloudWatch logs for false positives.

What Undercode Say

  • Key Takeaway 1: URIs are a superset of URLs—always validate query/fragment inputs in web apps.
  • Key Takeaway 2: Fragments (“) are client-side only but can leak data in single-page apps (SPAs).

Analysis:

Misconfigured URI handling is a top 10 OWASP risk. For example, APIs ignoring fragment validation may expose endpoints to bypass authentication (e.g., admin). Future attacks will likely target URI parsing in serverless architectures, where edge functions process fragments incorrectly.

Prediction

As SPAs and APIs grow, URI-based attacks (e.g., fragment hijacking) will rise. Developers must adopt strict RFC 3986 parsing and tools like URI.js (https://medialize.github.io/URI.js/) to sanitize inputs.

Commands/Code Snippets: 6

References: 1 (URI.js)

IT/Security Reporter URL:

Reported By: Activity 7339465135968735232 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: