lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: mbassett at (Bassett, Mark)
Subject: TinyURL

Anyone want an Asus Motherboard from newegg? :)


Mark Bassett
Network Administrator
World media company

-----Original Message-----
From: Joel R. Helgeson [] 
Sent: Wednesday, October 29, 2003 5:19 AM
Subject: [Full-Disclosure] TinyURL

This is an information leak rather than a real vulnerability. I thought
might be of interest to others... is a website that will convert a long url to a short
one. If
you want to email a link to say, driving directions on mapquest, the url
rather long and will get broken up. Tinyurl will store that long link,
give you a short one that looks like:

It appears that the last four letters are incremented one letter at a
so my URL may be aaaa, then aaab, and so forth.
If people are using the tiny URL service to pass along URL's to
information, it is easy to guess these URL's.

I recently sent an email to someone with a tinyurl, and decided to
one character in the url and came across a link to a kiddie porn site...

Its a coincidence that stab is a word, but its just a few characters off
from my URL, staa & stac are also valid URL's.

The TinyURL service should use a randomly created string, rather than
that is incremented by one character.  Regardless, users of this service
could have the information they intend to share with others viewed by
that types in the string.


Joel R. Helgeson
Director of Networking & Security Services
SymetriQ Corporation

"Give a man fire, and he'll be warm for a day; set a man on fire, and
be warm for the rest of his life."

Full-Disclosure - We believe in it.

Powered by blists - more mailing lists