2

Example:

Client: GET http://www.example.com/nonexistent/foo

Server: 200 OK <html... "Foo has three products in their Favorites list."... accompanied by three arbitrary products from other parts of the website />

I'm seeing this behavior on a site running Django. User Foo doesn't seem to have to be real. In fact this always works with any English language word or even popular names.

The server will return 404 if you request nonexistent paths containing random characters that aren't common names or words:

http://www.example.com/12345abcdef/hCt5

Is this some custom SEO logic written into their Python code, or is there something else entirely at work here? Thanks.

  • What server/version are you on? If you request /nonexistent/bar do you get a wholly different page returned? – MrWhite Feb 16 '17 at 9:48
  • I haven't yet been able to determine the version of Django. This is a penetration test so I need to be gentle. As to your second question, no, the page is the same each time, but is populated with content which seems to have no obvious relationship to whichever nonexistent page I requested. – Luke Sheppard Feb 16 '17 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.