Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That's wild! What do you mean they were requesting it one character at a time? The URL itself? If so,how do you know that? Do you also own urls in that "character space" leading up to your URL?


If the URL was https://myurl.com/some/thing/here I started seeing:

https://myurl.com/s

https://myurl.com/so

https://myurl.com/som

https://myurl.com/some

etc.

It took me a good 10 minutes to realize what was happening, especially since I was using a temp ngrok tunnel and no one should have had that URL.


Ahh gotcha. That's crazy.


My guess is that each frame of the video was OCR'd for text, so as the author typed a URL in one character at a time it was producing unique substrings on-screen and the youtube bot dutifully tried to fetch each of those unique substrings


That seemed like the gist of it. I wasn't surprised that it was OCR'ing text, but I was floored that it recognized a URL and started firing off requests.


https://-- DROP TABLE videos;


Was it YouTube that was requesting the link (maybe for anti-phishing purposes?)

Or Googlebot?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: