Full Disclosure: Re: Orkut Phishing Attack

From: Ajay Pal Singh Atwal <ajaypal_at_bbsbec.org>
Date: Thu, 21 Sep 2006 13:48:43 +0530 (IST)

Old bug in old bottle
This is an often discussed bug in FD

----- Pranay Kanwar <warl0ck_at_metaeye.org> wrote:
> orkut is an on line community that connects people through a network
> of
> trusted friends.
> The login url looks like this
>
> https://www.orkut.com/GLogin.aspx?done=http://www.orkut.com/
>
> After successfully logging in the user is redirected to
> http://www.orkut.com
> The url in the done argument can be changed to redirect to arbitrary
> website.
> for example
> https://www.orkut.com/GLogin.aspx?done=http://www.metaeye.org
> after logging in the user will be directed to metaeye.org
>

-- 
Sincerely
Ajay Pal Singh Atwal
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Received on Sep 21 2006