4 ms·

More like tricking you into interacting with a website in an unintended way, not only through GET parameters but through clickjacking and other tricks. https:/

• laumars 10y ago
  There's no such thing as "GET parameters". I assume you are referring to the query string but that's not necessary for encoding resource specific content. You could use the path structure (which is the common way these days), the domain name itself (eg different sub domains for different content), the user agent string, referrer, IP location (eg GeoIP). This is only just scratching the surface too as I've not even began to cover the client side rules one can apply to create a targeted page. Essentially anything that runs like an application can be dynamically generated to be specific to the visitor and since websites can be executed both at the server side and client side (eg Javascript) you're blindly placing you're trust on any URL. Frankly, these days you can't even trust the domain name itself since punycode and data inlining create easy vectors for spoofing, and DNS poisoning attacks are still widely possible.