4 ms·
It appears you can put a period anywhere within the ID after the initial "/" and it works: http://graph.facebook.com/robot.stxt http://graph.facebook.com/robot
by mitchellh 16y ago
It appears you can put a period anywhere within the ID after the initial "/" and it works:
http://graph.facebook.com/robot.stxt http://graph.facebook.com/robot.stxt
http://graph.facebook.com/r.o.b.o.t.s.t.x.t http://graph.facebook.com/r.o.b.o.t.s.t.x.t
This guy's actual short-URL is "robotstxt."
- deleted 16y ago[deleted]
- sev 16y agoIt's not just periods. They're filtering out certain characters [.,-] hxxp://graph.facebook.com/-----r.-o....b....o-t-s-t....x....t----....///////////___%%20%22/test/robots will still output the same result as http://graph.facebook.com/robotstxt http://graph.facebook.com/robotstxt
- theli0nheart 16y agoThis is the sort of thing that leads to exploits.