Full Disclosure mailing list archives
Re: Two other Google open redirects
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Wed, 14 Dec 2011 09:48:17 +1300
Riyaz Walikar wrote:
Here's another open redirect that works. https://accounts.google.com/o/oauth2/auth?redirect_uri=http://www.bing.com
Nice. That's a bit like the "backlink" ("bl") one from the settings page on the mobile page that Google fixed a week or so back after the spammers had been hammering away at it for a month or more.
This works as well. https://www.google.com/search?btnI&q=http://www.bing.com
That is the very long-known "I'm Feeling Lucky" search open redirector. http://www.virusbtn.com/resources/spammerscompendium/lucky.xml Again, the spammers used that for ages, but I was fairly sure that it had been fixed. Michal, Tavis -- regression management problems in the Googleplex? Surely not... Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Two other Google open redirects Riyaz Walikar (Dec 13)
- Re: Two other Google open redirects R0me0 *** (Dec 13)
- Re: Two other Google open redirects Nate Theis (Dec 13)
- Re: Two other Google open redirects Nick FitzGerald (Dec 13)
- Re: Two other Google open redirects Tavis Ormandy (Dec 13)
- Re: Two other Google open redirects R0me0 *** (Dec 13)