<story><title>This link says it&apos;s from YouTube but it&apos;s not</title><url>http://www.youtube.com/redirect?username=digitalhook&amp;q=http%3A%2F%2Fsecuritytube.net%2FSocial-Engineering-Attacks-using-Simple-Redirections-video.aspx&amp;video_id=Vgc3NVVpb8c&amp;event=url_redirect&amp;url_redirect=True&amp;usg=UE0DOmwjBRK-mgheFtW1hMTEvh4=</url><text></text></story><parent_chain></parent_chain><comment><author>kleevr</author><text>My first computer job as a teen was working at a small SEO shop (3 people) writing little cgi/perl scripts for this and that.&lt;p&gt;Yahoo&apos;s http server at that time used to take redirect URLs in this format: &quot;&lt;a href=&quot;http://yahoo/url/*http://exiturl/&quot; rel=&quot;nofollow&quot;&gt;http://yahoo/url/*http://exiturl/&lt;/a&gt;.  They were using these URLs on all search results, I&apos;m guessing to track click-throughs to improve rankings.  So I set up a script on our site to load an image using this format with the img src in the exit-url, and for the yahoo-url and we would round robin &apos;client&apos; links though.  Essentially spoofing legitimate search&amp;#38;clicks on yahoo from unique IPs from our site visitors.  Over the next two weeks all our sites started bubbling up in the results.  This worked for about a month before Yahoo changed something (I&apos;d guess they started validating the http-referrer or the exit-url), and it all stopped working.&lt;p&gt;But, for that brief window of time when it was working, I was the king of the high fives.&lt;p&gt;(FWIW, I don&apos;t do SEO work of any kind anymore, and I certainly don&apos;t advocate &apos;blackhat seo&apos;.)</text></comment>
<story><title>This link says it&apos;s from YouTube but it&apos;s not</title><url>http://www.youtube.com/redirect?username=digitalhook&amp;q=http%3A%2F%2Fsecuritytube.net%2FSocial-Engineering-Attacks-using-Simple-Redirections-video.aspx&amp;video_id=Vgc3NVVpb8c&amp;event=url_redirect&amp;url_redirect=True&amp;usg=UE0DOmwjBRK-mgheFtW1hMTEvh4=</url><text></text></story><parent_chain></parent_chain><comment><author>tednaleid</author><text>This is a common exploit.  So common that it&apos;s #8 on the 2010 OWASP top 10 most critical web application security risks: &quot;Unvalidated Redirects and Forwards&quot;.&lt;p&gt;&lt;a href=&quot;http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project&quot; rel=&quot;nofollow&quot;&gt;http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec...&lt;/a&gt;&lt;p&gt;Every web app developer should review these vulnerabilities before releasing their code to the world.</text></comment>