Sina Weibo gsid hijacking

This time I will post a method to hijack gsid. Only mobile browsers can log on to Weibo. Detailed Description: The user uses a mobile browser to log on to weibo.cn on Sina Weibo. The session id is stored in the URL weibo.cn /? Gsid = 3_5xxxx, so that as long as the page has an external link (even if it is redirected through 301/302), the target server of the external link can obtain the gsid from the Referer. Sina is currently very well protected against such external links. Most of them have removed the gsid on the jump page or directly used the <meta> jump method, so that no Referer trace is left, however, if the link you enter is in the form of an IP address, such as http: // 10.10.10, the url shortener is converted into a response of http://t.cn/xxxxx, as shown in (medium. After clicking "mobile edition", the user will jump to the target server and leave a Referer trace to hijack gsid. The reason for self-evaluation Rank 20 is that, after stealing the gsid, users who can scan for more posts are "Sina Weibo mobile edition" and send @ and comment on their posts in a targeted manner, trick them into clicking the link to spread session hijacking in the form of worms. For Methods see http://en.wikipedia.org/wiki/Samy_ (XSS)Solution:Your old defense against external links.