cookie stuffing普及篇(二)

netxboy

How and Why cookie stuffing works

Cookie stuffing,depending on the method used,works in different ways.The ultimate goal however is to get that darned affiliate cookie onto someones computer.

Cookies are passed in whats called a header.A web page doesn't have to be rendered for a header to be passed.Because of this,methods like image stuffing exist.The browser of your victim thinks is getting an image,but instead it gets a header with instructions to place a cookie on the computer.

In other methods of stuffing,you are actually opening up your affiliate url in a new window or in a frame.Because the url is actually opened,a cookie is placed.Not only is the header processed for cookie placement,the html is also rendered by the browser.In most cases,this is visually detectable by the user.Like in the case of javascript,a pop up window is used to display your affiliate url.Talk about annoying.

There are other methods you can use like a 1 pixel iframe.This is less detectable visually,but very easy to spot if someone went digging through the source for it.

Summary: a cookie is passed via a http header.A browser will not ignore a cookie header unless its security settings are instructed to do so.When the browser asks a server for an image and is returned with a webpage,a header is sent before the webpage.The browser aknowledges the header,and disregards the rest of the content.Thus a cookie is placed.

月光飞燕

已经翻译的不错了

netxboy

lol 翻译的还可以看懂 不过看英文的还是要舒服一点。
以上只是讲了cookie stuffing是如何工作已经为什么会存在cookie stuffing。
至于具体的方法很多人也可以写出自己的程序出来。看了部分cookie stuffer代码，感觉应该是cookie stuffing的高级用法了。
moder也说了正道即是王道，还有某前辈也说了搞正规，所以关于cookie stuffing以后不再提了

此情可待成追忆

非常感谢，从小英文就不及格，看来要去进修一下了，

netxboy

很blackhat的说，国外有人讨论也是很隐蔽的讨论
一个简单的例子：

1. http://www.im286.com/thread-3030307-1-1.html

复制代码

以后Cookie Stuffing话题不会再公开讨论，有兴趣的朋友可以私下和我讨论。

gagagugu

我要了解cookie stuffing，哪里可以看到

testman

谢谢了，。先看看再说。

带头大哥

。。。。。。。。。。掘墓啊