A lot of bots are sending this link to me on twitter, and obviously it must be something malicious. Can someone explain in a detailed manner that what does this link do and what is the vulnerability here?
This is the link:
It sets up and sends some variables to youtube then logs me out and then sends me to a bitly shortened link:
hxxp://bitly.com/2vK4Fga#1007310965585731584
I unshortened it and it came back with this :
hxxps://www.baidu.com/link?url=rZncHEMCsf6lt8ulV0jdARLcZOqlmQgim4767m7Jgya&wd=&eqid=c152d8470000dc7c000000065b734ee3
The site is a Chinese search engine! When I clicked on this link on my VM, it went to this website: hxxp://www.twitob.com/
which is some sort of gaining twitter follower site.
What is this link doing? I get that its setting some variables like ilo or ils and stuff, but I don't know what are they and why set them to these specific values? What are these variables?
I also found a report on a similar thing to this :
hxxps://www.openbugbounty.org/reports/222365/
but not sure if they are the same vulnerability or not, and that report doesn't explain anything.
One more weird thing is that usually I can easily unshorten the twitter's t.co
links, but when I unshorten the t.co
link that twitter gave me for these links, it turned into this no matter which website i used :
hxxps://www.google.com/url?sa=D&q=https://bitly.com/2vK4Fga&ust=1535028318764694&usg=AFQjCNF2RgdA4d9RaMK6foDsWn51_W3yYA
But you can clearly see that the actual link is something way different, what is going on?
shva=1
which meant "should have validated already"