5 ms·
Unvalidated Redirect in Google (or How Google Sent Me To Bing)
- e1ven 14y agoOne thing that's fun is that Google has a page detailing how to handle redirects on your own sites- http://googlewebmastercentral.blogspot.com/2009/01/open-redirect-urls-is-your-site-being.html http://googlewebmastercentral.blogspot.com/2009/01/open-redi...
- dhruvbird 14y agohypocrisy??
- davidu 14y agoOn the flip side, when Google does find a malicious URL being used in their redirector they are able to disable the URL and make the link invalid. They might not do this today, but Bitly now does, and so there's that.
- Firehed 14y agoShould be fun to see what happens when you get them to automatically blacklist their own sites... ;)
- arscan 14y agoI wonder if submitting the following link to HN would result in (google.com) being displayed next to the link instead of (tinfoilsecurity.com): http://www.google.com/finance/url?sa=D&q=http://blog.tinfoilsecurity.com/its-the-little-things-that-matter-or-how-goog http://www.google.com/finance/url?sa=D&q=http://blog.tin... I'd try, but I don't want to risk upsetting HN's moderators ;-)
- borski 14y agoHa, that's cute. I wonder if HN follows redirects in link-posting. My suspicion is no - you can post a 404, for example, and it'll just use the domain.
- rwos 14y ago1.) Yes, I think so. 2.) Don't worry, it has been done before: http://news.ycombinator.com/item?id=1259695 http://news.ycombinator.com/item?id=1259695 (That particular instance doesn't work anymore, though)
- stusmall 14y agoAlso, if you want to hide the URL in the link better, just pad the end of the query string with garbage and they won't even notice it: http://www.google.com/finance/url?sa=D&q=http://goo.gl/j10cW&sdf=189fdgjoidfg80dfgdfg http://www.google.com/finance/url?sa=D&q=http://goo.gl/j...
- g_lined 14y agoOr embed it with the government redirect mentioned. "Here's what Obama had to say about Google on yesterday's visit to Vermont!" http://labor.vermont.gov/LinkClick.aspx?link=http://www.google.com/finance/url?q=http://www.bing.com/?q=EVILWEBSITE http://labor.vermont.gov/LinkClick.aspx?link=http://www.goog...
- borski 14y agoLinkception. You can take that link and throw it in Google, and so on... At some point, maybe you'll hit a limit? Sounds like a fun test to run... ;)
- subway 14y agoYou could, of course, also use the hex representation of the ascii url to obscure it: http://www.google.com/finance/url?sa=D&q=%68%74%74%70%3a%2f%2f%62%69%6e%67%2e%63%6f%6d http://www.google.com/finance/url?sa=D&q=%68%74%74%70%3a...
- cominatchu 14y agoWe check for these types of vulnerabilities, and it's free to sign up: https://armorhub.com https://armorhub.com
- borski 14y agoWe found this by using the Tinfoil Security scanner, and it's free to sign up with us too - we check for this and quite a bit more. :) Sign up for free at https://www.tinfoilsecurity.com https://www.tinfoilsecurity.com
- ghayes 14y agoOn a blog post for Tinfoil Security, it would be better to phrase this as "We also check for these types of vulnerabilities." Tinfoil Security clearly found this specific vulnerability using their own product.
- darkarmani 14y agoThat would make sense if he left the comment on Tinfoil's actual blog post. Here in HN i don't think it matters.
- StevenXC 14y agoI couldn't get bit.ly to replicate the behavior that the article claimed: shortening .gov URLs using 1.usa.gov. Anyone else have any luck?
- darkarmani 14y agoThis is a good way to get around domain reputation ratings like SiteAdvisor. A domain like google isn't going to get hurt by a reputation service, but a small domain would get marked red after a few redirects to exploits or malware get crawled.