bugtraq - Google PR Mechanism Possible Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ab92512d0607101920n38e26769ra3ee049dcc36de68@mail.gmail.com>
Date: Tue, 11 Jul 2006 05:20:54 +0300
From: "cumhur onat" <cumhuronat@...il.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com, 
	vulnwatch@...nwatch.org, sec-adv@...unia.com
Subject: Google PR Mechanism Possible Vulnerability

PageRank is a formula developed by Google Search Engine to determine a web
pages "inbound link ranking" which affects its postion in search results.
To keep it basic we can say the more inbound link your webpage has, the
higher is its pagerank.
As you all can guess, the inbound links are calculated during the crawling
process of googlebot. The trick comes to place in this part.
Lets say we have a page A, and a page B which is indexed by Google and
another page C which we dont own.
What if we put some links like below on the "Page B":
<a href="
http://www.pagec.com/somepagewithxss.php?i=%3E%3Ca%20href%3D%22http%3A//www.pagea.com/pagea.html%22%3Euberalle%3C/a%3E
"></a>
As you guess when googlebot will follow the link on Page B and index page C,
it will see a link like:
<a href="http://www.pagea.com/pagea.html">uberalle</a>
And so inbound link count of "Page A" will increase, which will finally
increase the PR of "Page A" with the repeat of this process with different
pages that contains css flaws.
All this information is theoretic, and I never had time to spend for trying
this.
You can find the original version of this advisory on:
http://www.hoccam.com/pr.html

Cumhur Onat
cumhuronat@....net
cumhuronat@...il.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/