full-disclosure - Re: Google's blacklisted url database (phishing url database)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <447682.93039.qm@web37215.mail.mud.yahoo.com>
Date: Wed, 3 Jan 2007 01:24:04 -0800 (PST)
From: Rajesh Sethumadhavan <rajesh.sethumadhavan@...oo.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Google's blacklisted url database (phishing
	url database)

http://sb.google.com/safebrowsing/update?versio=goog-black-url:1:0000
  version info for each file:
  ---------------------------------------------------
[goog-black-enchash 1.15525]
[goog-black-url 1.7755]
[goog-sandbox-text 1.5]
[goog-white-domain 1.19]
[goog-white-url 1.371]
-----------------------------------------------------
  
interpolating "goog-sandbox-text" gives this URL:
  http://sb.google.com/safebrowsing/update?version=goog-sandbox-text:1:7753
  which sends:
  ------------------------------------------------
[goog-sandbox-text 1.5]
+sandbox        function%20getHandlers%28%29%7Breturn%5B%5D%7D%0A%3B%0A%0A
------------------------------------------------
  Oooh look, a hard-coded hash function. Paydirt ;)
   
  http://sb.google.com/safebrowsing/update?version=goog-white-domain:1:7753
  This one's presumably the white-listed domains:
   
  

moniker monikerd <monikerd@...il.com> wrote:
  
i see only two possible ways for google to get this kind of data.

google toolbar
or it buys/gets this information from some isp/companies/anybody with a big enough pipe ..
  
      On 1/2/07, php0t <php0t@...ro.hu> wrote:    
  How exactly does such data get captured? Somebody placed a link
somewhere with the url having the user/password in it ? What would be
the point of that? And if not, where did that come from? I peeked at
http://www.google.com/tools/firefox/safebrowsing/faq.html to learn more
but it only has obvious info.



-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk 
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of JM
Sent: Tuesday, January 02, 2007 11:17 PM 
To: full-disclosure@...ts.grok.org.uk
Subject: Re: [Full-disclosure]Google's blacklisted url database
(phishing url database)

I just played around a bit with those lists and as it seems, Google did 
a splendid job, even capturing some people's login data. Like here:
http://sb.google.com/safebrowsing/update?version=goog-black-url:1:7753 

Regards,
J.M.
Professional Lurker

>[By] "Rajesh Sethumadhavan" < rajesh.sethumadhavan@...oo.com>
>[Date]  Dienstag, 2. Januar 2007 18:42 
>[To]  full-disclosure@...ts.grok.org.uk
>[Subject] [Full-disclosure] Google's blacklisted url database (phishing 
url
>database)
>
> It is possible to access google`s blacklisted url database ( phishing
> url database )
>
> http://sb.google.com/safebrowsing/update?version=goog-black-url:1:1 
> http://sb.google.com/safebrowsing/update?version=goog-black-url:1:7998 
>
> http://sb.google.com/safebrowsing/update?version=goog-white-domain:1:19
,goo
>g-white-url:1:371,goog-black-url:1:7693,goog-black-enchash:1:15282
>
>
> This database (Part of Google Safe Browsing) can be used in any 
> anti-phishing commercial softwares :)
>
> Regards
> Rajesh Sethumadhavan
> http://www.xdisclose.com




 __________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/