Hidden Link Detector

Theabout 11 years ago

https://greasyfork.org/en/scripts/11623-hidden-link-detector

As many of you know, hidden links can be a significant for threat one's security all throughout the Internet, not limited to just Epicmafia. To combat this threat, have made a greasemonkey script that will detect and alert you of any hidden links on the current page. This script works on every website, including sites that have real-time updates like Skype.

If you haven't already, install the tampermonkey extension for chrome or the greasemonkey extension for FireFox so you can install my script.

Instructions

Normal links will be unaffected, links that go to a destination other than what they appear to go to are highlighted in yellow, and any links that will run JavaScript when they're clicked are highlighted in red.

Hovering over the links will also show you the real destination, or in the case of a JavaScript link, the script that will be run when you click on it.

As always, notify me of any issues or exploits you may find in the script.

adminabout 11 years ago
alright all fixed
1
cubabout 11 years ago
Zhuorb
So hidden links aren't actually hidden?

How does one fall for them lol
markdown hidden links still work using this trick, see my profile for reference
Satanabout 11 years ago
Croned
Will I get any reward/compensation for the competition stats tool, an issue which I already emailed you about and you read, but never replied to?
lmfao
Zhuorbabout 11 years ago
So hidden links aren't actually hidden?

How does one fall for them lol
Miloo7about 11 years ago
lilin
Miloo7
Lucid, you promised this, please deliver

dumb idea

if they are really saying nasty stuff kick them??
I was thinking this will help you reread in ranked games not just muting someone in unranked.
cubabout 11 years ago
i have faith in phill
Giga13about 11 years ago
wonky wheel
Hibikiabout 11 years agoedited
its heartbreaking to see lucid interested in fixing all this stuff but not having the time to sit down and do it. it's like he's your workaholic dad who promised to fix your bike but he's busy, can't help it, etc and eventually you just learn to bike with the wonky wheel
cubabout 11 years ago
hi
Hibikiabout 11 years ago
hello to you too cub
cubabout 11 years ago
im saying goodbye to my last hidden links
deleteddeletedabout 11 years ago
hi foxie, are u clever?
cubabout 11 years agoedited
itp testing alternatives

javascript://x%0aalert(%22hello%20%22+auth_top.textContent)

[url=x://]y[/url]
[url]x://[/url]

[url=ftp://]y[/url]
[url]ftp://[/url]

bug( affecting nobody at all ): ftp isn't recognized as a valid protocol in url tags
cubabout 11 years ago
javascript://x%0aalert%28%22with%20clicks%22%29

filthy cheats
deleteddeletedabout 11 years ago
Miloo7
Lucid, you promised this, please deliver

dumb idea

if they are really saying nasty stuff kick them??
Miloo7about 11 years ago
Lucid, you promised this, please deliver

Giga13about 11 years ago
This is so great, thanks to all involved!
adminabout 11 years ago
it will terminate if any of the images along the redirects are not an image
cubabout 11 years ago
ok it blocked a nefarious poking fake image

also what if i give it 4 fake images?

anyway tbh once you add csrf checks to all actions, this extra server strain won't be necessary anymore
cubabout 11 years ago
admin
foxie, it follows the redirects, up to 4, to check to see if the final destination is an image or not
princeabout 11 years ago
moon
mist
xela
*backflips into thread*

yo lucid, profile pets

*sashays outta here*
don't do this.
10
adminabout 11 years ago
foxie, it follows the redirects, up to 4, to check to see if the final destination is an image or not
AdrenalineMimeabout 11 years ago
rip hibiki's profile(s)
cubabout 11 years ago
additionally i think every profile(/markdown) image is broken
cubabout 11 years ago
it accepted my redirect (check the image url)

confirmed vulnerable but really that won't be a problem with csrf