- May 8, 2012
- 4,217
- 3,728
here is a little trick i found a while back to get backlinks from whois/statistic sites and such so i thought i'd share it ..oh and no, not by simply submitting 
these stats sites query your server signature from the httpd. normally it just displays the webserver software used on your server.
BUT you can change it to anything you want (for example with modsecurity for apache).
now you simply set your signature to :
then test it and you will see something like:
now when these sites query your website data they will put the html code from the server signature into their website, which obviously translates to a real ******** backlink.
some sites load the data in a text field or validate it so there it won't work, but many sites do not validate it in any way as they don't expect it to return html code
an example where it works: http://www.statsbay.com/www/argo-content.com
now you can either submit to these stats sites (there are many tools for example argo content's included fast domain indexer) or wait till they find your site.
some stats sites are also crawling the web, others wait for submissions. some have ******** links anyways, but others are nofollow or don't even allow submissions, but crawl sites themselfs.
however even for the sites which have normal links this is useful, since you can control the anchor or even highlight it or add an img (+ even run script code).
basically its an XSS, but hey they request the data from us, so their problem if they don't validate the input they scrape
anyways just a little extra trick in the blackhat arsenal, enjoy!
ps: why the f is "d0follow" blocked as word on this forum ? so whatever thats what the censored words ment
these stats sites query your server signature from the httpd. normally it just displays the webserver software used on your server.
BUT you can change it to anything you want (for example with modsecurity for apache).
now you simply set your signature to :
Code:
SecServerSignature "<a href='https://example.tld'>anchor</a>"then test it and you will see something like:
Code:
[root@argo www]# nc argo-content.com 80
HEAD / HTTP/1.0
HTTP/1.1 301 Moved Permanently
Date: Sun, 20 Sep 2015 01:28:35 GMT
Server: <a href='https://argo-content.com'><img src='https://argo-content.com/images/argo-logo.jpg'>ARGO httpd/1.0</a>
Location: https://www2.argo-content.com/
Cache-Control: max-age=604800
Expires: Sun, 27 Sep 2015 01:28:35 GMT
Connection: close
Content-Type: text/html; charset=iso-8859-1now when these sites query your website data they will put the html code from the server signature into their website, which obviously translates to a real ******** backlink.
some sites load the data in a text field or validate it so there it won't work, but many sites do not validate it in any way as they don't expect it to return html code
an example where it works: http://www.statsbay.com/www/argo-content.com
now you can either submit to these stats sites (there are many tools for example argo content's included fast domain indexer) or wait till they find your site.
some stats sites are also crawling the web, others wait for submissions. some have ******** links anyways, but others are nofollow or don't even allow submissions, but crawl sites themselfs.
however even for the sites which have normal links this is useful, since you can control the anchor or even highlight it or add an img (+ even run script code).
basically its an XSS, but hey they request the data from us, so their problem if they don't validate the input they scrape
anyways just a little extra trick in the blackhat arsenal, enjoy!
ps: why the f is "d0follow" blocked as word on this forum ? so whatever thats what the censored words ment
