TechKnowSurge
TechKnowSurge Catalog Videos HTTP 302 Cushioning
VideoSecurityFree

HTTP 302 Cushioning

A 302 cushioning attack exploits HTTP redirect responses to silently send users to a malicious site while they believe they are visiting a legitimate one. Understanding HTTP response codes is essential to recognizing how this redirection-based deception operates.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

HTTP response codes are standardized status indicators returned by web servers to communicate the outcome of a client request. These codes are grouped by range: 100-level codes are informational, 200-level codes indicate success, 300-level codes signal redirects, 400-level codes reflect client errors, and 500-level codes indicate server errors. A familiar example is the 404 error, which means the requested resource could not be found. Within the 300 range, a 301 response means a resource has moved permanently, while a 302 response means it has moved temporarily — and the browser follows that redirect automatically on the user's behalf. A 302 cushioning attack weaponizes this redirect mechanism. When a user requests a legitimate resource, the server responds with a 302 code that redirects the browser to a different location. In a malicious scenario, that new location is a site controlled by an attacker, potentially hosting malware or a phishing page. Because the redirect is seamless and largely invisible to the end user, the victim typically has no awareness that they have been routed away from the intended destination. The attack is effective precisely because it takes advantage of a standard, trusted web protocol rather than requiring the user to take any suspicious action.

What you'll learn

What's covered

302 Cushioning Attack

Key terms

302 Cushioning Attack
An attack that exploits HTTP 302 temporary redirect responses to silently redirect users from a legitimate site to a malicious one without their knowledge.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Malware
Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.

Topics

Http Protocol Web Security 302 Redirect Social Engineering Phishing Application Layer Attacks

Transcript

Another way to trick the user would be to do a 302 cushioning attack. In our scenario, let's say a user is using a computer to access a website. The client machine is going to ask for a resource based off the URL. The URL is going to point to a specific resource, and then that web server will then respond back.

Response codes

The web server will respond back with one of many different codes. It'll be the 100, the 200, 300, 400, or 500 level code. The 100 level, and there's multiple underneath this, would be informational. The 200 means that there's success. That's what we're looking for, that's what we're hoping for. The 300 level would be a redirect. The 400 level means that there's a client error, and the 500 level means that there's a server error. An example of this is you might have seen the 404 error: something's not found, the resource isn't found.

To dig a little deeper into a couple of the 300 messages here, we've got 301, which means that resource has been moved permanently, or a 302, which means the resource has been moved temporarily. So if a resource has been moved, like a web page, then it will redirect that user to the new resource. What that looks like is the user has reached out to the server, the server says that resource has been temporarily moved, go look over here for it, and then it will go to, in this case we're saying a web page, go to that new web page and then get that web page.

The cushioning attack

A cushioning attack is where it accesses the resource but then gets redirected to a new web page, maybe something that has some sort of malicious software on it, and then they get that malicious software. So this is the 302 cushioning attack: the user has been redirected. They think they're on the original site, and instead they're on a different site. We're just using a redirect to redirect the user from one site to another for some sort of nefarious purposes.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →