Author Topic: change browser header - see articles for free?  (Read 89 times)

Vesp

  • Administrator
  • Foundress Queen
  • *****
  • Posts: 3,130
change browser header - see articles for free?
« on: April 04, 2010, 04:11:26 AM »
I have noticed that a lot of sites allow for googlebots to see the articles, while they do not allow for normal people to see them. There are some firefox add-ons that allow you to easily change your browser header to appear as a Google bot. I installed one, thinking I'd be able to appear as a Google bot, and get free articles. However -- this isn't the case and it still wants me to log in. So I thought it also might be IP address, so I went through Google translate, knowing that this has been known to act as a proxy, but I still have the same problem.
How is it that the Google bots are still able to see the journal articles, and not me? Do you know of anyway around this? I think if we found a trick like this, it would be very useful.
Bitcoin address: 1FVrHdXJBr6Z9uhtiQKy4g7c7yHtGKjyLy

Ventillator

  • Larvae
  • *
  • Posts: 40
Re: change browser header - see articles for free?
« Reply #1 on: April 04, 2010, 03:15:02 PM »
It would indeed be useful Vesp. There are a number of journal articles i am dying to read. But they are so expensive. I Don't understand though, i would have thought that it would have been the IP address that the journal serves use as a basis to identify google bots. Not the header. I Would have thought that headers would have been too easy to spoof obviously. And it seems like the journals have now realized that flaw?
Organic Chemistry Is For People Who Like To Cook

Enkidu

  • Global Moderator
  • Foundress Queen
  • *****
  • Posts: 677
Re: change browser header - see articles for free?
« Reply #2 on: April 04, 2010, 06:26:27 PM »
They considered this at bl, but no solution was found.

Vesp

  • Administrator
  • Foundress Queen
  • *****
  • Posts: 3,130
Re: change browser header - see articles for free?
« Reply #3 on: April 05, 2010, 02:11:43 AM »
I'm not seeing it on BL, could you give a link?
Bitcoin address: 1FVrHdXJBr6Z9uhtiQKy4g7c7yHtGKjyLy

Sedit

  • Global Moderator
  • Foundress Queen
  • *****
  • Posts: 2,099
Re: change browser header - see articles for free?
« Reply #4 on: April 05, 2010, 05:16:54 AM »
If thats all that needs to be done that would be a cake walk with a programing language such as visual basic. The header is a simple function and changing the name of window is easy. Still I doubt this is all it would take to convince the programs your a google bot. Odds are that is an IP based event.
There once were some bees and you took all there stuff!
You pissed off the wasp now enough is enough!!!

Vesp

  • Administrator
  • Foundress Queen
  • *****
  • Posts: 3,130
Re: change browser header - see articles for free?
« Reply #5 on: April 05, 2010, 05:59:04 AM »
There is a firefox add on that does it, so no need for programming.
IP is probably the case -- turns out the googlebots and the google translation page/server use different IP addresses, and so my experiment of using google translate as a proxy didn't work either.
I assume that you probably can't get a proxy using a google bot IP so its pretty hopeless.. unless their is a chance that msn, yahoo or other would use the same IP address for a translator as well as their bots, but I think that is highly highly unlikely.
Bitcoin address: 1FVrHdXJBr6Z9uhtiQKy4g7c7yHtGKjyLy

no1uno

  • Global Moderator
  • Foundress Queen
  • *****
  • Posts: 681
Re: change browser header - see articles for free?
« Reply #6 on: April 05, 2010, 01:50:59 PM »
You could build a cookie (with the caveat that you'd need to get a 'real' bot-cookie first & reverse engineer it) and then go web-crawling... The easiest way I can think of to pretend to be a bot is to be one, just set up a bot and get it to look for keywords and any pdf's with those keywords... Would take some serious sorting through, but it should be doable
"...     "A little learning is a dang'rous thing;
    Drink deep, or taste not the Pierian spring:
    There shallow draughts intoxicate the brain,
    And drinking largely sobers us again.
..."

Naf1

  • Foundress Queen
  • *****
  • Posts: 753
Re: change browser header - see articles for free?
« Reply #7 on: April 06, 2010, 01:47:53 AM »
Referrer spoofing

Some websites, especially many pornographic paysites, utilize referrer information to secure their materials: only browsers arriving from a specified set of approved login pages are granted access. This facilitates the sharing of materials among a group of cooperating paysites. Additionally a site may want users to click through pages with advertising content before directly being able to access a downloadable file - using the referring page or referring site information can help a site redirect unauthorized users to the landing page the site would like to use.
If attackers acquire knowledge of these approved referrers, which is often trivial because many sites follow a common template, they can use that information combined with this exploit to gain free access to the materials.
Spoofing often allows legitimate access to a site's content where the site's web server is configured to block browsers that do not send referrer headers. Website owners may do this to disallow hotlinking.
It can also be used to defeat referrer checking controls that are used to mitigate Cross-Site Request Forgery attacks.

From WIki.

Also the searches generate .txt files or just raw metadata from pdf files to parse and index, if the pdfs permissions are not readable by world even googlebots wont get access to them (just metadata in the form of .txt or even the contents of the metadata loaded straight into an array functioning as memory in the code not even an actual file which then gets automatically indexed). lol I have been doing a little bit of study on search engines lately. If you were lucky you would get access to the text generated from a pdf, we need to spoof .edu sites that get automatic access (imho). If we could find the approved referrers for example sciencedirect, and spoof them we could set up a web portal that lets you surf with those credentials (like an online proxy).

Vesp

  • Administrator
  • Foundress Queen
  • *****
  • Posts: 3,130
Re: change browser header - see articles for free?
« Reply #8 on: April 06, 2010, 01:56:18 AM »
That is a great idea -- spoofing an .edu could be really tricky though. Is it even really an option?
Bitcoin address: 1FVrHdXJBr6Z9uhtiQKy4g7c7yHtGKjyLy

Ventillator

  • Larvae
  • *
  • Posts: 40
Re: change browser header - see articles for free?
« Reply #9 on: April 06, 2010, 02:48:51 PM »
Sounds like an absolutely awesome idea to me too. But you need to find the approved referrers first. How can we find them??
Organic Chemistry Is For People Who Like To Cook

no1uno

  • Global Moderator
  • Foundress Queen
  • *****
  • Posts: 681
Re: change browser header - see articles for free?
« Reply #10 on: April 07, 2010, 12:59:23 AM »
Googlebots, etc. are well behaved little beasties that don't go where they are told not to go...

Other bots aren't well behaved at all and ignore the sites "robots.txt" and go wherever they please (they can be programmed to ignore it, or more precisely, deprogrammed from seeing it).

The simplest way I can think of to pretend to be an edu site (with the requisite permissions) is to setup a program to try username/password combos until you get several that work (preferably from several .edu sites).

Grab the PHP toolbar and see if you can grab the request information when logging in to one of these, as you know your own login & password, you can then use CAIN to try various decrypts on the php request to see how the username/password are encoded.

Use that knowledge when trying various password/username combinations against the login at edu sites... those bits make up the cookie(s), to pretend to be a user, you'll need that. If you can pretend to be multiple users all at the same time, you can download entire volumes in quick time...

« Last Edit: April 07, 2010, 01:03:29 AM by no1uno »
"...     "A little learning is a dang'rous thing;
    Drink deep, or taste not the Pierian spring:
    There shallow draughts intoxicate the brain,
    And drinking largely sobers us again.
..."