February 16, 2003
Displaying referer links on blogs

Not a good idea without first cleaning them.. As I discovered today on another blog, way too easy to hijack via a javascript in the referer!

How is it done? Too easy..

<script>top.location.href='http://redirect_to_this_assholes_page';</script>

Edit: On second thought, this was probably targeting automatically-generated statistic pages... and a blog just got caught.. of course this is assuming someone didn't specifically target that blog but rather used a crawler.

Statistic pages makes more sense as hardly anyone ever visits their own and would likely not notice for a while, whereas with a busy blog it's spotted very quickly.

Posted February 16, 2003 01:09 PM in Blogging
TrackBack URL for this entry: http://www.unix-girl.com/mt/mt-tb.cgi/559
Comments
On February 16, 2003 02:15 PM Gavin added:

That's why it's important to check referers to make sure that it's both a valid site and it links to your site.

If you are using Awstats and MT (probably nobody) you can see http://www.estey.com/files/mt-awstats.zip for a little plugin.

#
On February 16, 2003 05:34 PM john added:

is that what happened to jeremy's site?

#
On February 16, 2003 06:23 PM Filip Salomonsson added:

And always, always HTML encode any dynamically generated content that isn't supposed to be HTML itself. It's really quite a simple concept, but it still tends to be forgotten way too often.

#
On February 17, 2003 10:48 PM action vance added:

"Statistic pages makes more sense as hardly anyone ever visits their own..."

Huh!!?! My blog is like - the only blog I visit on a daily basis. Even if I know that it hasnt changed.

I dont know what your talkin bout.

::g::

#
On February 19, 2003 01:47 PM Áedán added:

This particular issue is better known as Cross Site Scripting (shortened to XSS). Properly done, it can lead to all sorts of "interesting" issues, where data can be leaked out of a browser. A blog is a handy page to try and "exploit" with the aid these flaws, as it's not necessarily obvious where the real malicious code has come from.

As a general rule, any user input should be validated and sanitised before being used. That's just a sensible precaution.

#
On February 19, 2003 02:45 PM Scin added:

Áedán has it right, always filter any data you accept from a user. Also referer checking is nice, but it cannot be depended on. It is very easy to spoof since it relys on the clients browser to keep track of the referer. A perl script can be easily whipped up to act as a very simple browser which can post with any referer the programmer wishes to use.

#
On February 19, 2003 02:46 PM Scin added:

Áedán has it right, always filter any data you accept from a user. Also referer checking is nice, but it cannot be depended on. It is very easy to spoof since it relys on the clients browser to keep track of the referer. A perl script can be easily whipped up to act as a very simple browser which can post with any referer the programmer wishes to use.

#
On February 19, 2003 03:07 PM brandt added:

hey kasia, have you seen that this post has been referenced on El Reg?

you're famous! (in britain anyway...)

#
On February 19, 2003 03:27 PM Chris added:

The easiest way is use the striptags function in php. I only allow users to bold, link, and italicize. Keeps it simple. Good job in getting on the register.

#
On February 19, 2003 08:59 PM ElRed added:

Surely all you need to do is strip out the code for top.location.href='http://www.theregister.co.uk/content/55/29396.html'; anglebracket script close anglebracket? or maybe get the form to strip out top.location.href from any script which is input in the comments box?

#
On February 19, 2003 09:00 PM ElRed added:

Surely all you need to do is strip out the code for top.location.href='http://www.theregister.co.uk/content/55/29396.html'; anglebracket script close anglebracket? or maybe get the form to strip out top.location.href from any script which is input in the comments box?

#
On February 20, 2003 02:56 AM Tom added:

I also went to Mexico, found the people a bit strange but the food was great. Did anyone else see the Monkey directing traffic?

#
On February 20, 2003 05:58 AM Stefan added:

Congrats on the entry at The Register :)

As for the interesting problem, I have thankfully disabled trackbacks on my MT journal (elsewhere), so I don't think I have the problem.

Thanks for letting people know :)

#
On February 20, 2003 08:14 AM http referrer poisioning added:

I mentioned this idea about a week ago as well as a few possible routes for poisioning the http referrer field. http://www.stargeek.com

#
On February 20, 2003 09:19 PM Wolfgang Flamme added:

See both of these (in german):

http://www.sns1.de/partner/flamme/wflamme.nsf/Shortcut/XSSAttacke
http://www.sns1.de/partner/flamme/wflamme.nsf/Shortcut/ReferrerTrouble

Wolfgang

#
On February 22, 2003 05:33 AM Jessica added:

To protect your blogs from stupid referrers just disable html in your forms... Period.

no html access no tricky javascripts.


Jessi

#
Trackbacks
Geek Blog:The Register warns over referrer links
Is it me or is The Register a little late to the table on this? I have blogged about log
(read more)
February 19, 2003 04:17 PM