Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You accept comment submission via GET requests?

I may not have reverse engineered it fully, but something like this will allow me to post images around the internet that actually create comments on your site by the IP of the visitor.

<img src="http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=... />



Step 1: Link to a dynamically generated comment from my website

Step 2: Google, Bing, and others index my site

Step 3: Every bot that crawls my site is now a spambot


I think that would send a comment to moderation on their site, but yeah, submitting comments with GET is silly.


You can do that with POST too if the site doesn't have CSRF protection ;)


You cannot do it in drive-by format like you can with a GET. It's passive and can be posted almost anywhere, message boards, email, Facebook.


You can with simple JS posting a hidden iframe. This obviously won't work on 3rd party sites but works just fine from sites you control.


Drive-by format, that might have to go in my hacker news dictionary of awesome.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: