+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: IPlogging using google - revised version discussed with M L T. (/showthread.php?tid=5995551)
Pages: Pages
1
2
IPlogging using google - revised version discussed with M L T. - Mr. Robot - Aug 2, 2019
Code
https://www.google.com/search?q=%48%41%43%4B%46%4F%52%55%4D%53%2E%4E%45%54&btnI=&Search=cute%20kitten%20photosThis looks like it will go to google and/or search for kitten photos. You might be pleasantly surprised that instead you find yourself on Hackforums.
(WIP)
The best way to use this as using an IPlogger website itself wont quite work (afaik) you will buy a domain such as website.com
On the hosting for website.com - add an instant redirect to the google search results like this (save as index.html)
Code
<!DOCTYPE html>
<html>
<head>
<title>HTML Meta Tag</title>
<meta http-equiv = "refresh" content = "2; url = http://www.images.google.com/search?q=cute%20kitten%20photos" />
</head>
<body>
<p>ignore me</p>
</body>
</html>So now when you access your domain you should instantly get redirected to
Code
http://www.images.google.com/search?q=cute%20kitten%20photosThen what you would want to do is add an iplogger to the index.html page. This way whenever people access your domain it will log their IP address to a file on your website.
Finally what you would want to do is encode your URL so they can't read it such as %48%41%43%4B%46%4F%52%55%4D%53%2E%4E%45%54
That string will read as hackforums.net but we will make it your domain. The shorter your domain the smaller the overall URL will look. So for web.com we could use the below link to create the URL.
https://www.w3schools.com/tags/ref_urlencode.asp
w = %77
e = %65
b = %62
. = %2E
c = %63
o = %6F
m = %6D
Our end string = %77%65%62%2E%63%6F%6D
So now we throw that in our google URL.
Code
https://www.google.com/search?q=%77%65%62%2E%63%6F%6D&btnI=&Search=cute%20kitten%20photosSo if we click this link, we will be taken to web.com even though it looks like it should google search cute kitten photos.
https://www.google.com/search?q=%77%65%62%2E%63%6F%6D&btnI=&Search=cute%20kitten%20photos
>>If web.com was our own URL with our IPlogger, it would take them to web.com then shoot them back to google search of cute kitten photos without them realizing. This would allow us to log their IP and hope they are none the wiser.
You can check at any time to see if your URL is correct by simply trying to go to
http://%48%41%43%4B%46%4F%52%55%4D%53%2E%4E%45%54
RE: IPlogging using google - revised version discussed with M L T. - Dolipplo - Aug 5, 2019
Never seen this before !
Very intersting and HQ content. Can be really powerful in some situations.
RE: IPlogging using google - revised version discussed with M L T. - gogreendv - Aug 5, 2019
(Aug 2, 2019 04:37 PM)Mr. Robot Wrote:Great! Great! Great!Codehttps://www.google.com/search?q=%48%41%43%4B%46%4F%52%55%4D%53%2E%4E%45%54&btnI=&Search=cute%20kitten%20photos
This looks like it will go to google and/or search for kitten photos. You might be pleasantly surprised that instead you find yourself on Hackforums.
That's good idea.
RE: IPlogging using google - revised version discussed with M L T. - Mr. Robot - Aug 5, 2019
(Aug 5, 2019 02:51 AM)Dolipplo Wrote: Never seen this before !
Very intersting and HQ content. Can be really powerful in some situations.
Well hopefully it helps you!
RE: IPlogging using google - revised version discussed with M L T. - bexpr9 - Aug 6, 2019
q=%48%41%43%4B%46%4F%52%55%4D%53%2E%4E%45%54
It's good application of the google functions.
Hackers can use it for phishing attacks.
Glory to your wonderful sense!
RE: IPlogging using google - revised version discussed with M L T. - Mr. Robot - Aug 7, 2019
(Aug 6, 2019 12:04 AM)bexpr9 Wrote: q=%48%41%43%4B%46%4F%52%55%4D%53%2E%4E%45%54
It's good application of the google functions.
Hackers can use it for phishing attacks.
Glory to your wonderful sense!
It can be used for a lot :)
RE: IPlogging using google - revised version discussed with M L T. - ririki - Aug 8, 2019
That's interesting but there is some sort of algorithm.
Some of my websites didn't went through, it went into google search bar instead of re-direct and sometimes it also redirected to completely different website.
RE: IPlogging using google - revised version discussed with M L T. - Mr. Robot - Aug 12, 2019
(Aug 8, 2019 05:24 AM)ririki Wrote: That's interesting but there is some sort of algorithm.
Some of my websites didn't went through, it went into google search bar instead of re-direct and sometimes it also redirected to completely different website.
Were they full URLs with like /index.html or just website.com
RE: IPlogging using google - revised version discussed with M L T. - wikileaks - Aug 12, 2019
I don't understand this is expected behavior, I was able to do this with twitter and got bountied, but
IP Logging with google is worth nothing, it may help an attacker but its still worth nothing fuzzing about.
millions of sites run off google, so an open redirect has to exist either way.
RE: IPlogging using google - revised version discussed with M L T. - Mr. Robot - Aug 12, 2019
(Aug 12, 2019 04:33 PM)wikileaks Wrote: I don't understand this is expected behavior, I was able to do this with twitter and got bountied, but
IP Logging with google is worth nothing, it may help an attacker but its still worth nothing fuzzing about.
millions of sites run off google, so an open redirect has to exist either way.
When there are new exploits out for the newest versions of browsers, this type of attack can be used to infect people by going google > website > google without a visitor noticing.
Quickly allowing you to hack them.
While there are numerous redirects and while this is expected behavior, it has many use cases - using google on certain websites that only trust google links is another example.
The same way steam was exploiting users by trusting some links.
RE: IPlogging using google - revised version discussed with M L T. - duplex - Aug 12, 2019
This is pretty amazing, wow
RE: IPlogging using google - revised version discussed with M L T. - wikileaks - Aug 12, 2019
(Aug 12, 2019 04:37 PM)Mr. Robot Wrote: When there are new exploits out for the newest versions of browsers, this type of attack can be used to infect people by going google > website > google without a visitor noticing.
Quickly allowing you to hack them.
While there are numerous redirects and while this is expected behavior, it has many use cases - using google on certain websites that only trust google links is another example.
The same way steam was exploiting users by trusting some links.
Yes but Steam is much smaller than google, but you can't infect people with this without UI.
I found something similar with zendesk where I was able to download any file I wanted but it still required a click of a button.
This is helpful but useless, plus at this point google is at the top when it comes to spreading through this method :P
I like the bug but you wont do much.
RE: IPlogging using google - revised version discussed with M L T. - ririki - Aug 12, 2019
(Aug 12, 2019 04:28 PM)Mr. Robot Wrote: Were they full URLs with like /index.html or just website.comMainly just website.com
For example HaveFriday.com and I was sent to HaveFun.org -- HaveFriday was not registered domain.
Then I also tried Website.net and instead of redirecting me, it searched it over google.
Then I also tried random words and it re-directs me to random websites.
https://www.google.com/search?q=%48%55%53%4B%2E%4F%4D&btnI=&Search=cute
%48%55%53%4B%2E%4F%4D = HUSKY.COM and it was redirect to https://huskrestaurant.com/
RE: IPlogging using google - revised version discussed with M L T. - Mr. Robot - Aug 12, 2019
(Aug 12, 2019 04:42 PM)wikileaks Wrote: Yes but Steam is much smaller than google, but you can't infect people with this without UI.
I found something similar with zendesk where I was able to download any file I wanted but it still required a click of a button.
This is helpful but useless, plus at this point google is at the top when it comes to spreading through this method :P
I like the bug but you wont do much.
What? Of course you can infect people without user interaction? Let me guess, you heard JDBs are no longer a thing and just assume browser exploits don't exist nor come out weekly.
(Aug 12, 2019 04:43 PM)ririki Wrote: Mainly just website.com
For example HaveFriday.com and I was sent to HaveFun.org -- HaveFriday was not registered domain.
Then I also tried Website.net and instead of redirecting me, it searched it over google.
Then I also tried random words and it re-directs me to random websites.
https://www.google.com/search?q=%48%55%53%4B%2E%4F%4D&btnI=&Search=cute
%48%55%53%4B%2E%4F%4D = HUSKY.COM and it was redirect to https://huskrestaurant.com/
Try this one.
Code
https://www.google.com/search?q=%68%75%73%6B%79%2E%63%6F%6D&btnI=&Search=cuteRE: IPlogging using google - revised version discussed with M L T. - ririki - Aug 12, 2019
(Aug 12, 2019 04:54 PM)Mr. Robot Wrote: Try this one.
Codehttps://www.google.com/search?q=%68%75%73%6B%79%2E%63%6F%6D&btnI=&Search=cute
Yeah, looks like it's working.
I only used capital letters, it might have been the thing.