pretty crazy Google SEO hole got plugged
 

In a nutshell, looks like he found a hi ranking site, found an open redirect, then pinged his site through the open redirect.

Only $1337 reward.

I am wondering how many people were already using this trick.

Google bug bounty for security exploit that influences search results - Tom Anthony

he could have made much more than that.
damn those whitehats

Saw this the other day. Very surprised the guy didn't exploit this.

Yup, could have made millions easy.

Great thread as always lezinterracial i read that article from beginning to end and back again, thank you.

I'm shocked , and delighted, that it took Google 6 months to fix this AND they only paid $1,337 for something that is going to astronomically change the quality of Google's search results.

@Tube Ace looking at Google's response, including their denial of importance, length of time to fix, and miniscule bounty, I'm betting there are similar variants of this wide open because Google's foes feel similar behavior has many legitimate uses "..we were unable to get a definitive decision, if it would be possible to address this behavior with the redirect chain without breaking many legitimate use cases."

So Google thinks similar off domain/cross domain redirect chains to unrelated domains have legitimate uses, even after this bug... interesting.

I remember back in the day, during my tampering with penis pills and such stuff, some of us "used that trick" to make sure we get the cookie saved on surfer's computer.

It came down to making MY site navigation something like:

http://www.penis-pills-mainsite.com/....COM/home.html
and all links in main menu like that

never imagined it could be done for much more than just cookie shit :1orglaugh

lol and got a l33t reward for this ahahah

my first thought also.

also that wasn't some super secret, there were people selling this as seo service on fiverr few years ago.

What a dumbass

More money, more problems?

They pay $1337 on purpose. Any old schooler should be able to recognize.

My Skype id is misspell of it :upsidedow

Great article, thank you for sharing this.
WG