将网站站点/域名登陆重定向到其他地方？
骗子是否有可能将您的域名的网站/登陆重定向到其他地方？假设访问者的目标网站是 knowledgenotebook.com，但骗子将用户重定向到 google.com 或 yahoo.com 或其他任何网站？而且这样做是随机的，因此，它可以尽量避免被发现。
Is it possible for crook to redirect website site/landing to your domain to elsewhere? Say, a visitor's intended website is, knowledgenotebook.com, but the crook redirected the user to google.com or yahoo.com or anything else? And doing so randomly, so, it can try to avoid detection.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我相信您可以通过 DNS 缓存中毒 或 XSS。
如果发生 DNS 中毒，URL 中仍会显示knowledgenotebook.com。对于 XSS，我认为它必须有新的 URL。
你说的随机是什么意思？就像用户 X 会被重定向但用户 Y 和 Z 不会一样？如果这就是你的意思，那么他们可能会使用 XSS 对其进行随机化。我不认为它可以使用 DNS 中毒来随机化......
I believe you can do that with DNS cache poisoning or XSS.
With DNS poisoning it would still say knowledgenotebook.com in the URL. With XSS i think it would have to have the new URL.
What do you mean by randomly? As in user X will get redirected but users Y and Z will not? If that is what you mean then they could probably randomize it with XSS. I don't think it could be randomized using DNS poisoning...
是的，这是可能的。他可以使用多种技术来实现这一点，例如 DNS 劫持、IP 欺骗、ARP 中毒、主机文件编辑等。 Hakin9 是一本非常好的杂志，适合对安全问题感兴趣的初学者（但不仅仅是）
Yes it is possible. He can use several techniques to achieve that like DNS hijacking, IP spoofing, ARP poisoning, edition of hostfile etc. Hakin9 is a very good magazine for beginners (but not only) interested in security matter
是的，他可以通过修改 hostsfile 来做到这一点
Yes, he can do it by modifying the hostsfile
是的，这是可能的。确保用户真正访问您的网站的最佳方法是使用 SSL 证书。 HTTPS 协议要求浏览器验证它尝试获取的域名是否与证书的域名匹配（否则您将在浏览器中收到安全警告）。
实际上没有任何方法可以阻止某人执行此操作的所有可能方式，因为它可能发生在服务器和用户之间的任何地方。 DNSSEC 应该可以帮助解决其中一些问题，例如缓存中毒。
Yes, it is possible. The best way for your users to ensure that they are actually getting your site is to use an SSL certificate. The HTTPS protocol requires browsers to verify that the domain name it is trying to get matches the domain name of the certificate (otherwise you'll get a security warning in your browser).
There's not really any way to prevent all the possible ways that someone can do this, as it can happen anywhere between your server and the user. DNSSEC is supposed to help with some of these issues, like cache poisoning.