Last of OWASP’s Top 10 Still a Potent Threat

Akamai's Threat Research Team analyzed an SEO manipulation campaign that abused open redirect functionality in 553 web pages (including sites belonging to large organizations and government entities), finding 270 of those pages vulnerable to reflected XSS; the report shows how the common "notify and confirm" redirection pattern can be exploited by attackers and recommends whitelisting, robots.txt disallow, and link/meta nofollow as mitigations.