Open redirects – a vulnerability class no one but attackers cares about

Re:Open redirects – a vulnerability class no one but attacke... by dsfyu404ed on Friday January 04, 2019 @07:58AM (#18823642)

Back in the day you could change some URL parameters and make it look like Toys R Us was selling firearms on their website because they used the same ecommerce back end as a sporting goods store. Like you'd go to the URL and it would be a hunting rifle (or whatever) but it would be on the Toys R Us site.

I don't think Toys R Us was ever harmed but it was mildly amusing and I'm sure a few people's panties got knotted after they found out Toys R Us doesn't actually sell firearms and they got all enraged over nothing.

[ Parent | on HN ]

Re:Open redirects – a vulnerability class no one but attacke... by cosmie on Friday January 04, 2019 @03:58PM (#18827542)

I hadn't heard of this issue specifically, but it sounds like you may be talking about eBay Enterprise[1]. They ran a lot of e-commerce operations for brick and mortar stores at one point, including both Toys R Us and Dick's Sporting Goods.

[1] https://en.wikipedia.org/wiki/EBay_Enterprise

[ Parent | on HN ]