XSS, Adwords, affiliates.
It’s fairly clear that the majority of people know about blackhat ppc affiliate techniques. But how can you take these a step further, were you so inclined..
The nature of this method lies in marrying two technologies together. The problem with XSS exploits is the lack of targeted visitors via your link. Current methods include sending high volumes of spam e-mail with an apparently valid link. They marry phishing with XSS. Then when someone bites, you clone their session. There are inherent flaws with this method.
Adwords allows you to direct cheap targeted traffic for a brand site, that you have discovered an xss exploit in. Lets take; for example - Viking Direct. A huge company and affiliate program.
You could hijack their brand ad with the following destination url:
What is the benefit? You can gain an appearance of authenticity, their brand ad is already domain directed. You could insert your own affiliate redirect. You could change the script and insert an invisible iframe to load whatever you wished. For example - Stuff cookies, lots of them.
Or grab a document.cookie - and log into someone elses sessions. Make orders on their account, buy yourself a tv. That sort of bad stuff.
Using adwords and XSS together is not currently being exploited probably because there is some vital knowledge that is required to pull this off. But let me tell you, it’s extremely easy. I could have fished hundreds of session ids this morning from Viking Direct were I so inclined and go get myself those fifty 60″ tvs that my house just really needs.
Childs play..
Leave a Reply