Re: TinyURL

["Joel R. Helgeson" <joel () helgeson com>]

hehehe
It appears that people use this service as an attempt to obfuscate the
usernames and passwords to protected websites and ftp servers that they
email out.  I'm finding a lot of urls that read like:
http://username:password () www protectedsite com/members
ftp://user:pass () ftp securedftp com/private/sourcecode

Looks like they wanted to get someone into their site, but didn't want to
actually 'give' the username and password out, so they tinyurl'ed it.
Someone wanna perl script it and find a goldmine it all out?

Joel R. Helgeson
Director of Networking & Security Services
SymetriQ Corporation

"Give a man fire, and he'll be warm for a day; set a man on fire, and he'll
be warm for the rest of his life."

----- Original Message ----- 
From: "Joel R. Helgeson" <joel () helgeson com>
To: <full-disclosure () netsys com>
Sent: Wednesday, October 29, 2003 4:19 AM
Subject: [Full-disclosure] TinyURL


> This is an information leak rather than a real vulnerability. I thought it
> might be of interest to others...
>
> www.tinyurl.com is a website that will convert a long url to a short one.
If
> you want to email a link to say, driving directions on mapquest, the url
is
> rather long and will get broken up. Tinyurl will store that long link, and
> give you a short one that looks like: http://tinyurl.com/abcd
>
> It appears that the last four letters are incremented one letter at a
time,
> so my URL may be aaaa, then aaab, and so forth.
> If people are using the tiny URL service to pass along URL's to sensitive
> information, it is easy to guess these URL's.
>
> I recently sent an email to someone with a tinyurl, and decided to change
> one character in the url and came across a link to a kiddie porn site...
> http://tinyurl.com/stab
>
> Its a coincidence that stab is a word, but its just a few characters off
> from my URL, staa & stac are also valid URL's.
>
> The TinyURL service should use a randomly created string, rather than one
> that is incremented by one character.  Regardless, users of this service
> could have the information they intend to share with others viewed by
anyone
> that types in the string.
>
> Thoughts?
>
> Joel R. Helgeson
> Director of Networking & Security Services
> SymetriQ Corporation
>
> "Give a man fire, and he'll be warm for a day; set a man on fire, and
he'll
> be warm for the rest of his life."
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html