News for hackers. Stuff that matters.

A comment on Open redirects – a vulnerability class no one but attackers cares about. Parent comment

Re:Open redirects – a vulnerability class no one but attacke... by wtracy on Friday January 04, 2019 @04:25AM (#18822835)
That might not be an issue for Google, but I could see it being a big problem for a company that relies heavily on projecting a "family friendly" image (think Disney).
[ Parent | on HN ]
Re:Open redirects – a vulnerability class no one but attacke... by dsfyu404ed on Friday January 04, 2019 @07:58AM (#18823642)
Back in the day you could change some URL parameters and make it look like Toys R Us was selling firearms on their website because they used the same ecommerce back end as a sporting goods store. Like you'd go to the URL and it would be a hunting rifle (or whatever) but it would be on the Toys R Us site.

I don't think Toys R Us was ever harmed but it was mildly amusing and I'm sure a few people's panties got knotted after they found out Toys R Us doesn't actually sell firearms and they got all enraged over nothing.

[ Parent | on HN ]
Re:Open redirects – a vulnerability class no one but attacke... by cosmie on Friday January 04, 2019 @03:58PM (#18827542)
I hadn't heard of this issue specifically, but it sounds like you may be talking about eBay Enterprise[1]. They ran a lot of e-commerce operations for brick and mortar stores at one point, including both Toys R Us and Dick's Sporting Goods.

[1] https://en.wikipedia.org/wiki/EBay_Enterprise

[ Parent | on HN ]