full-disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031030005018.GA13809@digitalguardian.net>
From: jimmy at digitalguardian.net (Jimmy Alderson)
Subject: TinyURL

Haha,
   Interesting behavior here.  How is that http://www.tinyrul.com/dick
takes you to the home page of Dick Cheney?

-Jimmy


On Wed, Oct 29, 2003 at 09:11:37AM -0600, Bassett, Mark wrote:
> Anyone want an Asus Motherboard from newegg? :)
> 
> http://www.tinyurl/boob
> 
> 
> Mark Bassett
> Network Administrator
> World media company
> Omaha.com
> 402-898-2079
> 
> 
> -----Original Message-----
> From: Joel R. Helgeson [mailto:joel@...geson.com] 
> Sent: Wednesday, October 29, 2003 5:19 AM
> To: full-disclosure@...sys.com
> Subject: [Full-Disclosure] TinyURL
> 
> This is an information leak rather than a real vulnerability. I thought
> it
> might be of interest to others...
> 
> www.tinyurl.com is a website that will convert a long url to a short
> one. If
> you want to email a link to say, driving directions on mapquest, the url
> is
> rather long and will get broken up. Tinyurl will store that long link,
> and
> give you a short one that looks like: http://tinyurl.com/abcd
> 
> It appears that the last four letters are incremented one letter at a
> time,
> so my URL may be aaaa, then aaab, and so forth.
> If people are using the tiny URL service to pass along URL's to
> sensitive
> information, it is easy to guess these URL's.
> 
> I recently sent an email to someone with a tinyurl, and decided to
> change
> one character in the url and came across a link to a kiddie porn site...
> http://tinyurl.com/stab
> 
> Its a coincidence that stab is a word, but its just a few characters off
> from my URL, staa & stac are also valid URL's.
> 
> The TinyURL service should use a randomly created string, rather than
> one
> that is incremented by one character.  Regardless, users of this service
> could have the information they intend to share with others viewed by
> anyone
> that types in the string.
> 
> Thoughts?
> 
> Joel R. Helgeson
> Director of Networking & Security Services
> SymetriQ Corporation
> 
> "Give a man fire, and he'll be warm for a day; set a man on fire, and
> he'll
> be warm for the rest of his life."
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html