Open Redirect Found in Google. Mask Traffic & Bypass Spam Filters

**B166ER** · #1 (**permalink**) 07-02-2009, 12:59 AM

Google Redirect

It has always been possible to use google's search links to redirect your traffic but it was always pretty pointless. The redirects dont last long and the user gets an error message like "someone is trying to redirect you" where you then have to click a link to proceed to the site. That sucks so fuck that.

The other day I was poking around big G hoping I would get lucky and find a google script that doesn't check the redirect and BAM! I totally found one so heres how you do it.

The vulnerable script is in Google Images. You just have to take a google images page URL and pass it the wrong page (your page) where it expects the URL of the page where the image resides. You see below I have created a redirect to BHW:

Code:

http://www.google.com/imgres?imgurl=http://i299.photobucket.com/albums/mm296/sumira2008/vampires-3.jpg&imgrefurl=http://www.blackhatworld.com&usg=__fYNbWbd67PFZ-6B3IbPQEyFsgvs=&h=1024&w=788&sz=94&hl=en&start=38&tbnid=1kkww8BhFlMxuM:&tbnh=150&tbnw=115&prev=/images%3Fq%3Dhot%2Bvampire%26ndsp%3D18%26hl%3Den%26sa%3DN%26start%3D36

=)

hello49 · #2 (**permalink**) 07-02-2009, 01:03 AM

Thanks didn't know about this one. I'll have to find a good use for this

osmose01 · #3 (**permalink**) 07-02-2009, 02:25 AM

nice found m8

**biks** · #4 (**permalink**) 07-02-2009, 03:07 AM

OK, this looks cool. [please feel free to smack me on the back of my head]

Could you give me an example on what I would use this for? There's still a Google image icon at the top. How would you work that into whatever you're doing?

robbyc · #5 (**permalink**) 07-02-2009, 05:49 AM

Thank you for the script, but would you please suggest some ways to implement without having Google jump down my throat?

**B166ER** · #6 (**permalink**) 07-02-2009, 11:21 AM

by the way you can get rid of the google images frame by putting a simple frame breaker on your site.

Roversierr · #7 (**permalink**) 07-02-2009, 11:43 AM

Quote:

Originally Posted by burne

This has been a long unfixed vulnerability of google images.

Hi Guys

Thicko here !! Can someone.. step by step.. me through this process?-

(Sounds ideal-especially as I have a large number of google business listings. )

cheers

OldMadHatter · #8 (**permalink**) 07-02-2009, 11:59 AM

very interesting. will give it a try....

blazed · #9 (**permalink**) 07-02-2009, 07:37 PM

Wow! This is a huuuuge security flaw in google. Well done.

maineyak · #10 (**permalink**) 07-02-2009, 08:04 PM

Shorter version:

Code:

http://www.google.com/imgres?imgurl=http://i299.photobucket.com/albums/mm296/sumira2008/vampires-3.jpg&imgrefurl=http://www.blackhatworld.com

I've already got an idea for this, thanks!

unknown00 · #11 (**permalink**) 07-02-2009, 09:24 PM

interesting.. props on the find...

polix · #12 (**permalink**) 07-02-2009, 09:43 PM

thanks man