html geeks - read in re ebay

blighter · 21 Aug 2007 at 20:27

GeForce said:
And

http://202.71.103.2/~mailunumar/

redirects to eBay

/Edit: Oops someone already pointed that out...

lol

I'm still the highest bidder

I reckon we should all bid on it and keep going to see how far it goes

AndrewP · 21 Aug 2007 at 20:43

Code:

<A 
                              style="TEXT-DECORATION: none" 
                              href="http://202.71.103.2/~mailunumar/[email protected]"><IMG 
                              style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" 
                              height="4800" alt="" 
                              src="http://members.lycos.co.uk/contactusername/s.gif" 
                              width="1300"></A>

The gif and link are entered using a mass of encoded characters (vB converts to the above) starting at line 252, column 112 in the source.

blighter · 21 Aug 2007 at 20:45

AndrewP said:

Code:

<A 
                              style="TEXT-DECORATION: none" 
                              href="http://202.71.103.2/~mailunumar/[email protected]"><IMG 
                              style="BORDER-RIGHT: medium none; BORDER-TOP: medium none; BORDER-LEFT: medium none; BORDER-BOTTOM: medium none" 
                              height="4800" alt="" 
                              src="http://members.lycos.co.uk/contactusername/s.gif" 
                              width="1300"></A>

The gif and link are entered using a mass of encoded characters (vB converts to the above) starting at line 252, column 112 in the source.

Very interesting. Nice post

GeForce · 21 Aug 2007 at 20:50

AndrewP said:
The gif and link are entered using a mass of encoded characters (vB converts to the above) starting at line 252, column 112 in the source.

Aah I see. Thanks for that

I was wondering.

V4NT0M · 21 Aug 2007 at 20:52

sure thats against toc

Subliminal Aura · 21 Aug 2007 at 20:53

Yeh but the script behind it is looking for a hax0r big time....

http://202.71.103.2/~mailunumar/[email protected]\r`ls``pwd`

and then submit the form with some details which gives us a server error(500) on ....

http://www2.fiberbit.net/form/mailto.cgi
[email protected]

Nice redirection

at poor mr kjps's expense :rolleyes:

Trouble is that we are hoping mailto.cgi is not vulnerable... I can't be a$$ed to check it out.

* I'll leave it for the script kiddies to play with

AndrewP · 21 Aug 2007 at 21:00

I reported it as 'Link to chat systems outside eBay' but there wasn't anywhere to put the technical explanation, or ask why those characters don't get stripped/sanitised when the auction description is entered.

Trifid · 21 Aug 2007 at 21:09

AndrewP said:
I reported it as 'Link to chat systems outside eBay' but there wasn't anywhere to put the technical explanation, or ask why those characters don't get stripped/sanitised when the auction description is entered.

I also reported it, but under circumventing ebay fees, would be better to have an other where you can enter a description.

blighter · 22 Aug 2007 at 17:33

someone outbid me

Cupra · 22 Aug 2007 at 17:37

its ended for me