5 ms·
You accept comment submission via GET requests? I may not have reverse engineered it fully, but something like this will allow me to post images around the int
by Kudos 14y ago
You accept comment submission via GET requests?
I may not have reverse engineered it fully, but something like this will allow me to post images around the internet that actually create comments on your site by the IP of the visitor.
<img src="http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=Spam%20urls http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=... />
- supjeff 14y agoI think that would send a comment to moderation on their site, but yeah, submitting comments with GET is silly.
- fooyc 14y agoYou can do that with POST too if the site doesn't have CSRF protection ;)
- Kudos 14y agoYou cannot do it in drive-by format like you can with a GET. It's passive and can be posted almost anywhere, message boards, email, Facebook.
- 1qaz2wsx3edc 14y agoDrive-by format, that might have to go in my hacker news dictionary of awesome.
- driverdan 14y agoYou can with simple JS posting a hidden iframe. This obviously won't work on 3rd party sites but works just fine from sites you control.
- mratzloff 14y agoStep 1: Link to a dynamically generated comment from my website Step 2: Google, Bing, and others index my site Step 3: Every bot that crawls my site is now a spambot