Re: Orkut Phishing Attack

[Ajay Pal Singh Atwal <ajaypal () bbsbec org>]

Old bug in old bottle
This is an often discussed bug in FD

----- Pranay Kanwar <warl0ck () metaeye org> wrote:
> orkut is an on line community that connects people through a network
> of
> trusted friends.
> The login url looks like this
>
> https://www.orkut.com/GLogin.aspx?done=http://www.orkut.com/
>
> After successfully logging in the user is redirected to
> http://www.orkut.com
> The url in the done argument can be changed to redirect to arbitrary
> website.
> for example
> https://www.orkut.com/GLogin.aspx?done=http://www.metaeye.org
> after logging in the user will be directed to metaeye.org


-- 
Sincerely

Ajay Pal Singh Atwal

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/