A vulnerability in Google AdSense: Automatic extraction of links to ads

TL;DR

This paper reveals a security vulnerability in Google AdSense that allows automatic extraction of ad links using XSS and web crawler techniques, enabling covert ad access and click simulation.

Contribution

It introduces a novel method exploiting XSS and web crawling to bypass AdSense barriers and retrieve ad links, highlighting a security flaw in the system.

Findings

Ad links can be extracted automatically using the described method.

The technique enables background ad loading and click simulation.

Google AdSense's security measures are vulnerable to this approach.

Abstract

On the basis of the XSS (Cross Site Scripting) and Web Crawler techniques it is possible to go through the barriers of the Google Adsense advertising system by obtaining the validated links of the ads published on a website. Such method involves obtaining the source code built for the Google java applet for publishing and handling ads and for the final link retrieval. Once the links of the ads have been obtained, you can use the user sessions visiting other websites to load such links, in the background, by a simple re-direction, through a hidden iframe, so that the IP addresses clicking are different in each case.