TechKnowSurge
TechKnowSurge Catalog Videos Universal Resource Locator (URL) Scanning
VideoSecurityFree

Universal Resource Locator (URL) Scanning

URLs can be manipulated to disguise malicious destinations, making URL scanning an essential tool for identifying and blocking deceptive web addresses before they cause harm. Understanding how URLs are structured helps explain why this type of filtering is a critical layer of network security.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Every URL follows a standardized format defined by the Uniform Resource Identifier specification, containing distinct components such as the protocol schema, host domain, directory path, file reference, and optional user credentials. When a user enters a URL into a browser, the host portion is resolved through DNS to an IP address, allowing network packets to be routed to the correct server. Once there, additional path information identifies the specific site, directory, and file being requested, and that resource is downloaded and rendered on the local machine. The user information field — a legitimate part of the URI format used in certain authenticated or secure connections — is rarely displayed in standard browsing and is largely unfamiliar to most users. This obscurity makes it a practical tool for attackers who want to craft URLs that appear to point to a trusted domain while actually directing traffic elsewhere. By placing a recognizable domain name before the at symbol in a URL, a threat actor can make the address look like it leads to a legitimate site, while the true destination follows the at sign and is where the connection actually goes. URL scanning and filtering technologies are designed to detect exactly these kinds of manipulations. By analyzing the full structure of a URL rather than just what appears readable at a glance, these tools can identify suspicious patterns, flag deceptive addresses, and prevent users from being redirected to malicious or unauthorized destinations. Implementing URL filtering is a straightforward but effective measure for strengthening endpoint and network security.

What you'll learn

What's covered

URL Scanning & Filtering

Key terms

Uniform Resource Locator
URL
A standardized address used to identify and locate specific resources on the web, consisting of components such as schema, host, directory, and file path.
Domain Name System
DNS
A hierarchical naming system that translates human-readable domain names into IP addresses.
Phishing
A social engineering attack that uses deceptive emails or messages to trick users into revealing sensitive information.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
URL Filtering
A security control that inspects and evaluates URLs to detect obfuscation techniques or malicious destinations and block access to harmful sites.
Obfuscation
The deliberate manipulation of data, code, or a URL to disguise its true purpose and evade detection by security tools or users. Malware authors use obfuscation to hide malicious behavior; attackers use it in phishing URLs to disguise destinations.

Topics

Url Scanning Url Filtering Web Security Threat Detection Network Security Social Engineering

Transcript

URLs can be deceiving. That is, people can sneak certain pieces of information into that URL that can cause harm to our computer. So let's take a look at what that looks like and what URL scanning is.

What a URL Identifies

Essentially, the web is just a bunch of different resources, resources that I need to locate. So we have URLs, universal resource locators, to identify these resources that are on the web, and then get that resource so we can display it on our machine. If I'm on this machine right here, then I pull up a browser, I type in the URL, and it goes and identifies those resources, and then essentially those resources get downloaded onto my machine.

Let's take a deeper dive into this. Uniform, because they all have the same type of format. Resource, because it's locating a specific resource, like maybe it's HTML code or maybe it's a picture. Then the locator, and it's locating this resource.

So how do we identify a specific resource? First of all it has the schema here, and the schema is going to be the protocol, so it's using HTTPS. Then the host. This gets translated into an IP address so the packet can be routed to the proper location, so the packet destination IP address will be whatever DNS lookup determines this domain and this host is. So then it has an IP address to be able to route to that server.

Then what it can do is use this information right here to identify what site it's referencing, because a single server that has a single IP address can have many different sites. So this identifies the site that it's associated with. This is the directory within that site, because it's just a bunch of files and folders and directories. So it's looking in this directory, the resources directory, and it's looking for a specific file. In this case right here it's picture2.jpg, so that's the file. And then there's some other information to help identify specific parts of that file, so we can query or look at a specific fragment of it. In this case right here, with a JPEG, it probably doesn't have that and just has: this is the resource that we're looking at. Then it will essentially download, or grab a copy of, that resource, and that resource will be sent over to the machine and then that machine can display it on the computer.

The URI Format and the User Info Field

This all follows the uniform resource identifier. URI is just the format; this defines the format of how to identify certain resources. In this case, what's not usually up in our URL of our browser is this part right here, the user info at whatever. This would be user information for making this connection, so you can make a secure connection. Maybe we're SSHing into something, or maybe we want some sort of secure connection. We put the user in here so that it can identify us as being a specific user.

How This Is Used to Trick Users

The thing is, this can be snuck into the URL to trick end users. Right here, where are we going to? We're going to www.google.com. Well, what about this right here? We're not going to www.google.com. It looks like we are going to the site, but look, we've got the at sign. So what we are going to instead is this email address right here. That's where we're going to, and then it's going to interpret this as being the user side of this, in which case this server probably doesn't care what the user side is. So now we're going to what looks like google.com, but we're actually going to another address. It's a way to trick end users.

Just to show you how this works, what we have here is what looks like it's going to www.google.com, but instead we're sending them to www.yahoo.com. So what I'm going to do is pull up a browser and paste it into here. Hit enter. Notice now we've gone to the Yahoo site, not the Google site.

URL Filtering

There is different software and devices that can help us do URL filtering. What that means is that it's going to look for little tricks like this to make sure we're not going to the wrong sites, and instead we're sticking to the legitimate sites. So we may want to do some sort of URL filtering.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →