+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: The Lounge (https://hackforums.net/forumdisplay.php?fid=25)
+---- Thread: DONT USE SNIP.LY LINKS (/showthread.php?tid=5900381)
DONT USE SNIP.LY LINKS - Vanderbilt - Oct 27, 2018
Just dont. I got a link like this.
http://snip.ly/fkrgxk/#https://www.advancedwebranking.com/
So, instead of giving me a redir, it sent me to a frame locked in it, probably like emulating the environment.
I went to the login page, still had the snip.ly part on it, and used the credentials, [email protected] and the password, fakeemail.
It sent a PUT request, not a POST requst but with the api, it is almost the same thing.
Probably to throw off web browsers or antiviruses
This is the post request for the logging into AWR
Code
Host: app.advancedwebranking.com
Origin: https://app.advancedwebranking.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: https://app.advancedwebranking.com/signin
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: _gcl_au=1.1.605893394.1540704780; _ga=GA1.2.455764686.1540704780; _gid=GA1.2.2121907769.1540704780; _dc_gtm_UA-61715-3=1; AWSALB=T9JUwnsD8ROVlIygx3wRfT1DYRzgkB0G5dAIlmK8G8Smhqfpm9/hdVbPcpT0895pwlMv0EaO0en0QbDX2ciHzZERhECRoVbUphmc23Nn1OCFCHh2t+lo1TLh9ahd; csrf_token=RQfuGdU68%2BDGyTNJcBx1bBs45yTIucZzSZVjO43WE3I%3D; PHPSESSID=gcd979au4hpsgjbja3fd95vvs2; amplitude_id_87adddfe6b223759ca176b2911430e04advancedwebranking.com=eyJkZXZpY2VJZCI6Ijk1YzFmMTNiLTY1NDMtNDMyNi04OGFhLTVhOThjMGE1MTY4NlIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTU0MDcwNTQ0MDg3MiwibGFzdEV2ZW50VGltZSI6MTU0MDcwNTQ0MDg3MiwiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9
csrf_token=JpWnbN33BRh5KHyUfKrVxy6T7YAF2CiVnUr9cr9vfx8oGxEpZFwFwIkFxtltSjeuw5bz+xPG4L3V41b62fnYNQ==&[email protected]&password=fakeemailNotice how my token was there with my email and pass
This is snip.ly's PUT request
Code
Host: snip.ly
Accept: */*
Origin: http://snip.ly
X-CSRFToken: null
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://snip.ly/render/fkrgxk/?_url=http%3A%2F%2Fsnip.ly%2Ffkrgxk%2F%23https%3A%2F%2Fwww.advancedwebranking.com%2F
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: __cfduid=d089565936693cd44dc34e6b4833ab7d31540455838; sessionid=xuwcw8qaiz7g9rbr2bcfvg41dukq74k1; _ga=GA1.2.1380611076.1540704777; _gid=GA1.2.1663019132.1540704777; _gat=1
change=page&is_landing_page_transition=false&time_on_page=28
csrf_token=JpWnbN33BRh5KHyUfKrVxy6T7YAF2CiVnUr9cr9vfx8oGxEpZFwFwIkFxtltSjeuw5bz+xPG4L3V41b62fnYNQ==&[email protected]&password=fakeemailSomething is fishy here but i cant put my finger on it. ill just put my email and password there instead
RE: DONT USE SNIP.LY LINKS - Zeus - Oct 30, 2018
Thanks for sharing the alert for us!