ScyScan - Free Online Security & Network Tools

ScyScan provides a suite of free security tools — try our web scanner, virus scanner, link checker, SSL checker, WHOIS lookup, and IP lookup all in one place.

Explore All Tools

Cybersecurity Toolkit

Choose from our range of free online security and network tools to protect your devices, websites, and online presence

Web Scanner

Check websites for vulnerabilities and other security issues, providing real-time results and detailed analysis.

Scan Website / URL

Virus Scanner

Scan files for malware, viruses, trojans, and other threats using multi-engine technology.

Scan Files

Link Checker

Verify URLs for safety, detect phishing attempts, and check if links lead to malicious websites.

Check Links

SSL Checker

Analyze SSL certificates, check expiration dates, and verify proper encryption implementation.

Check SSL

Whois

Get detailed domain registration information including owner details, registration dates, and expiration.

Lookup Domain

IP Lookup

Identify geographic location, ISP information, and other details about any IP address.

Lookup IP

Why Choose ScyScan

ScyScan brings together essential security and network tools in a single, free platform designed for everyday use

🔒

All-in-One Platform

Web scanner, link checker, virus scanner, SSL checker, WHOIS, and IP lookup — all available from one place.

🔄

Trusted Reliability

Built on up-to-date threat intelligence and network databases you can count on.

🚀

Results in Seconds

Most checks complete within seconds so you get answers fast.

💰

Completely Free

All our security and network tools are free to use with no hidden costs or fair use restrictions.

🌐

Online Access

No software installation required - access our tools from any browser, anywhere.

📊

Clear Reports

Receive straightforward analysis and easy-to-understand reports for every tool.

Built for Everyday Security

ScyScan combines multiple security data sources and network databases into one accessible platform. No complex setup — just enter what you need and get clear results.

Multiple Data Sources

Aggregated threat intelligence from trusted security feeds for comprehensive coverage

Network Databases

Access to extensive WHOIS and IP geolocation databases for accurate information

Privacy Focused

We respect your privacy and automatically delete scans and lookups after analysis

Continuously Updated

Data sources are refreshed regularly so you get current information.

How People Use ScyScan Tools

📧 Check Attachments

Use our virus scanner to check files before opening them

🌐 Audit Your Website

Run a web scan to check your website for known vulnerabilities

🔗 Verify Links

Use the link checker to test if a URL is safe before clicking

🔐 Inspect SSL

Check SSL certificate validity and configuration for any domain

🏢 Research Domains

Look up domain registration details with the WHOIS tool

📍 Trace IPs

Find geographic and network details for any IP address

Start Using ScyScan Tools

All tools are free and ready to use — no account or sign-up required

Explore All Tools

ScyScan - Free Online Security & Network Tools

ScyScan provides a suite of free security tools — try our web scanner, virus scanner, link checker, SSL checker, WHOIS lookup, and IP lookup all in one place.

Explore All Tools

Cybersecurity Toolkit

Choose from our range of free online security and network tools to protect your devices, websites, and online presence

Web Scanner

Check websites for vulnerabilities and other security issues, providing real-time results and detailed analysis.

Scan Website / URL

Virus Scanner

Scan files for malware, viruses, trojans, and other threats using multi-engine technology.

Scan Files

Link Checker

Verify URLs for safety, detect phishing attempts, and check if links lead to malicious websites.

Check Links

SSL Checker

Analyze SSL certificates, check expiration dates, and verify proper encryption implementation.

Check SSL

Whois

Get detailed domain registration information including owner details, registration dates, and expiration.

Lookup Domain

IP Lookup

Identify geographic location, ISP information, and other details about any IP address.

Lookup IP

Why Choose ScyScan

ScyScan brings together essential security and network tools in a single, free platform designed for everyday use

🔒

All-in-One Platform

Web scanner, link checker, virus scanner, SSL checker, WHOIS, and IP lookup — all available from one place.

🔄

Trusted Reliability

Built on up-to-date threat intelligence and network databases you can count on.

🚀

Results in Seconds

Most checks complete within seconds so you get answers fast.

💰

Completely Free

All our security and network tools are free to use with no hidden costs or fair use restrictions.

🌐

Online Access

No software installation required - access our tools from any browser, anywhere.

📊

Clear Reports

Receive straightforward analysis and easy-to-understand reports for every tool.

Built for Everyday Security

ScyScan combines multiple security data sources and network databases into one accessible platform. No complex setup — just enter what you need and get clear results.

Multiple Data Sources

Aggregated threat intelligence from trusted security feeds for comprehensive coverage

Network Databases

Access to extensive WHOIS and IP geolocation databases for accurate information

Privacy Focused

We respect your privacy and automatically delete scans and lookups after analysis

Continuously Updated

Data sources are refreshed regularly so you get current information.

How People Use ScyScan Tools

📧 Check Attachments

Use our virus scanner to check files before opening them

🌐 Audit Your Website

Run a web scan to check your website for known vulnerabilities

🔗 Verify Links

Use the link checker to test if a URL is safe before clicking

🔐 Inspect SSL

Check SSL certificate validity and configuration for any domain

🏢 Research Domains

Look up domain registration details with the WHOIS tool

📍 Trace IPs

Find geographic and network details for any IP address

Start Using ScyScan Tools

All tools are free and ready to use — no account or sign-up required

Explore All Tools

Relative Path Confusion

  • 警报等级:

  • Medium

  • 警报类型:
  • Active
摘要

The web server is configured to serve responses to ambiguous URLs in a manner that is likely to lead to confusion about the correct “relative path” for the URL. Resources (CSS, images, etc.) are also specified in the page response using relative, rather than absolute URLs. In an attack, if the web browser parses the “cross-content” response in a permissive manner, or can be tricked into permissively parsing the “cross-content” response, using techniques such as framing, then the web browser may be fooled into interpreting HTML as CSS (or other content types), leading to an XSS vulnerability.

解决方案

Web servers and frameworks should be updated to be configured to not serve responses to ambiguous URLs in such a way that the relative path of such URLs could be mis-interpreted by components on either the client side, or server side. Within the application, the correct use of the "" HTML tag in the HTTP response will unambiguously specify the base URL for all relative URLs in the document. Use the "Content-Type" HTTP response header to make it harder for the attacker to force the web browser to mis-interpret the content type of the response. Use the "X-Content-Type-Options: nosniff" HTTP response header to prevent the web browser from "sniffing" the content type of the response. Use a modern DOCTYPE such as "" to prevent the page from being rendered in the web browser using "Quirks Mode", since this results in the content type being ignored by the web browser. Specify the "X-Frame-Options" HTTP response header to prevent Quirks Mode from being enabled in the web browser using framing attacks.

其他信息
No Content Type was specified, so Quirks Mode is not required to exploit the vulnerability in the web browser.
参考

https://arxiv.org/abs/1811.00917

https://hsivonen.fi/doctype/

https://www.w3schools.com/tags/tag_base.asp