Re:XSS attacks on Googlebot allow search index manipulation
by tk2 on Friday July 19, 2019 @10:36AM
(#20478978)
I accidentally found this circa 2008. I found a xss vulnerability on a local news website, where I could inject js into the webpage URL.
I then posted a poc on my blog. The poc will create a img link to my blog.
To my surprise my blog ranked 2nd for the news name. The only explanation that I can think of was googlebot followed the poc link and thought the news site has a link to my blog. Of course this is only possible if googlebot execute js, which was not a standard for other crawlers at that time.
I believe the blackhat term for this is Google Bowling. Correct me if I'm wrong.
I then posted a poc on my blog. The poc will create a img link to my blog.
To my surprise my blog ranked 2nd for the news name. The only explanation that I can think of was googlebot followed the poc link and thought the news site has a link to my blog. Of course this is only possible if googlebot execute js, which was not a standard for other crawlers at that time.
I believe the blackhat term for this is Google Bowling. Correct me if I'm wrong.