full-disclosure - Google URL Redirection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 8 Apr 2011 16:41:14 +0530
From: satyam pujari <satyamhax@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Google URL Redirection

*Hello List,*

*
*

*Here's a Google URL Redirection Vulnerability which could be used in
phishing attack. A simple way to bypass Google redirect notice.*

======================================================================================================================================

*1-Open:*

*http://www.google.com/url?sa=D&amp;q=http://www.0x.t35.com*

*2-Copy Link:*

"The previous page is sending you to *http://www.0x.t35.com*"

*
http://www.google.com/url?q=http://www.0x.t35.com&amp;ei=r7meTaKlF426vwPe2uCRBQ&amp;sa=X&amp;oi=unauthorizedredirect&amp;ct=targetlink&amp;ust=1302249655383154&amp;usg=AFQjCNG4ATH5al6movivnWoeLQJc1ABtSg
*

*
*

*3-Send to victim: *(*http://www.0x.t35.com* could be a different
(malicious) site hosting an exploit kit/malware which is not blacklisted ye*
t)*

*
http://www.google.com/url?q=http://www.0x.t35.com&amp;ei=r7meTaKlF426vwPe2uCRBQ&amp;sa=X&amp;oi=unauthorizedredirect&amp;ct=targetlink&amp;ust=1302249655383154&amp;usg=AFQjCNG4ATH5al6movivnWoeLQJc1ABtSg
*

*
*

In a real attack (phishing) scenario, this one can be used in a "quick
targeted" attack as the link (ei/ust/usg params ) "expires" after some
time.If the link expires the attacker follows step 2 again.

======================================================================================================================================

Here's one more which can be used effectively in a phishing attack.

http://translate.google.com/translate?hl=ko&amp;sl=en&amp;u=http://0x.t35.com<http://translate.google.com/translate?hl=ko&sl=en&u=http://0x.t35.com>

I guess, here the content stored in
http://0x.t35.com<http://translate.google.com/translate?hl=ko&sl=en&u=http://0x.t35.com>
is
copied to and executed by http://translate.googleusercontent.com.

======================================================================================================================================
Regards,
@Satyamhax
http://esploit.blogspot.com/

Gr33tZ @blackhatlinux @alchemist16

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/