Re: [luv-talk] Fwd: Intel's Management Technology is indeed vulnerable

4 May 2017

      Hi,

On 04/05/17 10:48, Trent W. Buck via luv-talk wrote:
...
Andrew McGlashan via luv-talk wrote:
...
On 03/05/17 23:59, Douglas Ray via luv-talk wrote:
...
Firmware remote vulnerability in Intel business products
Can I preview a bitlink before clicking on it?
https://support.bitly.com/hc/en-us/articles/230650447-Can-I-preview-a-bitlin...
Yeah, but using bit.ly has other problems -- not least of which is they
track the s*** out of them...
$ curl -so/dev/null -Iw'%{redirect_url}\n' http://bit.ly/2qyHCQn
    https://arstechnica.com/security/2017/05/intel-patches-remote-code-execution...
Then browse to that link directly, which will bypass (some) of the tracking.
If this is a common task for you, you can wrap it into a shell function or whatever.
#!/bin/sh -e
    xdg-open "$(curl -so/dev/null -Iw'%{redirect_url}\n' "$1")"
Thanks, that's an interesting method, but sometimes you get redirect
after redirect [and maybe a bunch more] .... This is due to extra
methods used in tracking; so I have a script for that too.  I'm sure it
isn't perfect either, but it works well most of the time, some links
fail to give me the /right/ end link for some reason (it might be user
agent strings).

Oh and yes, my script follows the redirects via socks5 proxy, but the
final URL is clean and the browser has less information as to how the
link was gotten too when it gets to load the URL; there will be
exceptions when the final URL is actually one that looks normal, but is
actually specific due to how it was gotten -- that is, you would never
get to that link without following the path of the initial tracked link.

$ cat get-real-url
#!/bin/bash

set -u

get_link_base() {
	echo "${1}"|awk -F/ '{print $1"//"$3}'
}

LINK="${1}"
[ -z "${LINK}" ] && { echo bad link; exit; }

# PRE Adjust domains for .onion addresses where possible
#  (some links are better changed immediately, others POST work)
ALT_LINK="${LINK/facebook.com/facebookcorewwwi.onion/}"

# IF link adjusted above, use new link
[[ "${LINK}" = "${ALT_LINK}" ]] || {
	echo -e "\nNew alternate link: ${ALT_LINK}"
	LINK="${ALT_LINK}"
}

link_base=$(get_link_base "${LINK}")
echo -e "\nFirst Link Base: ${link_base}"
loc_lnk='not yet'

while :
do

	echo '------------------------------'

	# If download link redirects to a new Location, use that
	echo -en "\nGet location at $(date)\t\t"
	loc_lnk=$(
		curl -Is "${LINK}" | \
			awk '/^[Ll]ocation:/{$1="";gsub(/^[ \t]+|[\r]/, "");print}'
	)
	# the following doesn't keep following the redirects
	#loc_lnk=$(curl -so/dev/null -Iw'%{redirect_url}\n' "${LINK}")
	[ -z "${loc_lnk}" ] && {
		echo -e "no more redirects"
		break
	}

	echo -e "${loc_lnk}"

	# fix relative link to full link if we've lost base link
	if [[ "${loc_lnk:0:1}" = "/" ]]
	then
		loc_lnk="${link_base}${loc_lnk}"
	else
		link_base=$(get_link_base "${loc_lnk}")
		echo -e "\nNew Link Base: ${link_base}"
	fi

	echo -e "\nlocation link: ${loc_lnk}"
	LINK="${loc_lnk}"

done

# POST Adjust domains for other special .onion addresses where possible
# - done here as post processing because in this case,
#   it is cleaner then pre-processing and gives a better result
ALT_LINK="${LINK/propublica.org/propub3r6espa33w.onion/}"

# IF link adjusted above, use new link
[[ "${LINK}" = "${ALT_LINK}" ]] || {
	echo -e "\nNew alternate link: ${ALT_LINK}"
	LINK="${ALT_LINK}"
}

echo
echo '------------------------------'

echo
echo "${LINK}"
echo

# Now remove all parameters passed with the URL
LINK=${LINK%%[?]*}
echo "${LINK}"
echo
echo firefox \""${LINK}"\"
echo
echo

Cheers
A.