Internet Forensics

Redirection

I have already mentioned server-based redirection in Chapter 4 as a way to disguise the true location of a web site. I want to revisit the topic here in the context of server header lines.

The series of events that take place during page redirection can be illustrated in the following block of headers. In this case the browser originally requested the URL http://www.ora.com, which is an alternate name for the O’Reilly web site. The first block of headers is returned by the server that hosts that site.

    Connecting to www.ora.com[208.201.239.37]:80... connected.
    HTTP request sent, awaiting response...
     1 HTTP/1.1 302 Found
     2 Date: Mon, 11 Apr 2005 23:45:45 GMT
     3 Server: Apache/1.3.33 (Unix) mod_throttle/3.1.2
     4 Location: http://www.oreilly.com/
    [...]
    Location: http://www.oreilly.com/ [following]
    [...]
    Connecting to www.oreilly.com[208.201.239.37]:80... connected.
    HTTP request sent, awaiting response...
     1 HTTP/1.1 200 OK

The first header line, number 1 in the example, includes the response code 302 Found. Any code in the 300 series denotes some form of redirection and 302 should be used in cases where the file has been moved temporarily to another server. In practice, this is used whether the change is permanent or temporary. Whenever a 3xx code is returned, the server must also tell the browser where it can find the requested page. It does this by including a Location header. Here the new location is http://www.oreilly.com, which is the primary O’Reilly web site. I have edited ...