Full Disclosure: Orkut Phishing Attack

[Pranay Kanwar <warl0ck () metaeye org>]

orkut is an on line community that connects people through a network of
trusted friends.
The login url looks like this

https://www.orkut.com/GLogin.aspx?done=http://www.orkut.com/

After successfully logging in the user is redirected to http://www.orkut.com
The url in the done argument can be changed to redirect to arbitrary
website.
for example
https://www.orkut.com/GLogin.aspx?done=http://www.metaeye.org
after logging in the user will be directed to metaeye.org

--
When a fox sees a rabbit it comes running, but not for help.
[warl0ck[at]metaeye.org]$ wvisit http://www.metaeye.org



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/