You probably know that I'm not that fond on Wikipedia and their pompous sysadmins who think XSS and SQL injection is a non-issue but yet fixed it --see archive-- but now they've managed to raise quite a stir personally. I have one of the first MySQL cheatsheets that gave away most MySQL injection samples for education on the subject. I knew it sat on Wikipedia when you searched for SQL injection. Guess what happened? it got removed. Okay, I don't care it's useless traffic for me anyway. But then I looked up another page on Wikipedia about CSRF or Cross Site Request Forgeries. Guess what, all my links gone. Including the first Google CSRF issue that plagued Google Adsense I talked about. Also the CSRF issue on Amazon by Chris Shiflett is gone from the page. I had a reader who had put the links back on it two times by now. They even didn't notified the first author who wrote the page, nope just deleted. Good job Wikipedia! can anyone give me one good reason why? I know one: censorship. I accuse them and their editors of censorship from now on.So what do you do then as a good citizen? you show them that they are vulnerable to CSRF themselves. We don't need to use TOR we use the IP address of each and every surfer that visit our testpage. You know stumbleupon? good, they just sent me 100K. All I need to do is redirect those stumblers to an iframe embedded form and Wikipedia will be littered with fake edits, and all those stumblers will be blocked, all automatically. You see, I'm not a bad guy but don't fuck me over in your ivory towers. Welcome to the issue that is called CSRF! I also thought about letting stumblers put the links back on it through CSRF, or 100.000 random edits. And I could. They probably never noticed it if I did. But I am kind today I have just one request: stop censoring stuff that might not fit your moral code.So Wikipedia, censor this:
Wikipedia Censorship.
By secgeeks - Posted on February 10th, 2008
Tagged:
71
vote
http://www.secgeeks.com/trackback/1447
















