Re: [Full-Disclosure] TinyURL

From: Jimmy Alderson (jimmy_at_digitalguardian.net)
Date: 10/30/03

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-Disclosure] New variant of Nachi ?" 
    To: full-disclosure@netsys.com
Date: Wed, 29 Oct 2003 19:50:18 -0500

    Haha,
       Interesting behavior here. How is that http://www.tinyrul.com/***
    takes you to the home page of *** Cheney?

    -Jimmy

    On Wed, Oct 29, 2003 at 09:11:37AM -0600, Bassett, Mark wrote:
    > Anyone want an Asus Motherboard from newegg? :)
    >
    > http://www.tinyurl/boob
    >
    >
    > Mark Bassett
    > Network Administrator
    > World media company
    > Omaha.com
    > 402-898-2079
    >
    >
    > -----Original Message-----
    > From: Joel R. Helgeson [mailto:joel@helgeson.com]
    > Sent: Wednesday, October 29, 2003 5:19 AM
    > To: full-disclosure@netsys.com
    > Subject: [Full-Disclosure] TinyURL
    >
    > This is an information leak rather than a real vulnerability. I thought
    > it
    > might be of interest to others...
    >
    > www.tinyurl.com is a website that will convert a long url to a short
    > one. If
    > you want to email a link to say, driving directions on mapquest, the url
    > is
    > rather long and will get broken up. Tinyurl will store that long link,
    > and
    > give you a short one that looks like: http://tinyurl.com/abcd
    >
    > It appears that the last four letters are incremented one letter at a
    > time,
    > so my URL may be aaaa, then aaab, and so forth.
    > If people are using the tiny URL service to pass along URL's to
    > sensitive
    > information, it is easy to guess these URL's.
    >
    > I recently sent an email to someone with a tinyurl, and decided to
    > change
    > one character in the url and came across a link to a kiddie porn site...
    > http://tinyurl.com/stab
    >
    > Its a coincidence that stab is a word, but its just a few characters off
    > from my URL, staa & stac are also valid URL's.
    >
    > The TinyURL service should use a randomly created string, rather than
    > one
    > that is incremented by one character. Regardless, users of this service
    > could have the information they intend to share with others viewed by
    > anyone
    > that types in the string.
    >
    > Thoughts?
    >
    > Joel R. Helgeson
    > Director of Networking & Security Services
    > SymetriQ Corporation
    >
    > "Give a man fire, and he'll be warm for a day; set a man on fire, and
    > he'll
    > be warm for the rest of his life."
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-Disclosure] New variant of Nachi ?"