toolbar linkhttp://www.reddit.com/tb/9cefy
submitted on20 Aug 2009
points1431
up votes2279
down votes848

funny

(145920 subscribers)

a community for 1 year

Submit a link
to anything interesting: news article, blog entry, video, picture...

Recently viewed links

clear

1

comments

sorted by:
new
hotcontroversialtopold
formatting helphide help

MySears 27 points28 points 6 hours ago[-]

We discovered earlier today that someone visiting our site had defaced a limited number of product pages. It’s important for our customers to know that we have no reason to believe that any of our customer or financial data were compromised. We’ve already taken steps to prevent this from happening again. We sincerely apologize to any customers who may have seen this on our site.

phyzome 0 points1 point 1 hour ago* [-]

Aw, don't get too upset. It's a rookie mistake, sure, but everyone's a beginner at some point.

Just try not to hire people that inexperienced, 'kay?

dawnerd 0 points1 point 23 minutes ago[-]

Or maybe they shouldn't use a shitty commerce system. Likely they didn't build it from the ground up.

myliverhatesme 4 points5 points 2 hours ago[-]

I don't think you get what's going on here. The category name being displayed was being retrieved from the URL. It wasn't just a few random products. People could have made up fake category names for any product and sent the URL to anyone else and they would have seen the made up categories. The products were real and the categories were not.

For example: http://www.sears.com/shc/s/p1015312605_00387581000P?vName=Computers+%26+Electronics&cName=Laptops&sName=Laptops

Before, I could have changed that to: http://www.sears.com/shc/s/p1015312605_00387581000P?vName=Computers+%26+Electronics&cName=Dead%20Babies&sName=Laptops and changed the category name displayed on the page. What they appear to be doing now is getting the category from the product id, which they should have done to begin with. What this also means is they can get rid of that extra junk in their URL and make it a little cleaner.

Gravity13 5 points6 points 3 hours ago[-]

Dear Sears, you fucked up.

play3393 4 points5 points 4 hours ago[-]

http://www.reddit.com/tb/9cm4b

So you forced Reddit to take out the link?

tellingyouwhyiupvote 12 points13 points 6 hours ago* [-]

Upvoted because someone from Sears took the time to sign up and post this.

Edit: Also, as a thank you for the pre-internet fap material.

play3393 4 points5 points 4 hours ago[-]

You may want to hold out on that upvote:

http://www.reddit.com/tb/9cm4b

Gravity13 1 point2 points 5 hours ago[-]

How do you know it's somebody from Sears?

MySears 3 points4 points 4 hours ago[-]

It's for real - MySears Community (www.mysears.com) is an online customer community and I'm one of the mods (Michelina).

romcabrera 3 points4 points 3 hours ago[-]

So, did you have complaints from real clients? Was this a real issue?

tellingyouwhyiupvote 1 point2 points 4 hours ago[-]

Upvoted because from-the-horse's-mouth verification is GEFM.

Gravity13 0 points1 point 4 hours ago* [-]

Liar. Right now he has (1|0), 1 upvote, 0 downvotes. You didn't upvote him!

jaydorn 0 points1 point 8 hours ago[-]

Doh, fun while it lasted, but they seem to have fixed this little URL string "bug"

cabritar 0 points1 point 8 hours ago[-]

Any one have a picture as to what this looks like when it works? I joined this party late and it looks like Sears fixed the issue.

rarerumrunner 0 points1 point 9 hours ago[-]

Error - You broke Sears.

masspromo 20 points21 points 9 hours ago* [-]

TMZ has a report about sears having a human BBQ listed, the sears people are going nuts LOL

http://www.tmz.com/2009/08/20/the-perfect-grill-for-a-cannibal/#comments

tellingyouwhyiupvote 7 points8 points 5 hours ago[-]

Upvoted because making it onto TMZ means we're collectively as great as Michael Jackson.

BiggerBalls 5 points6 points 8 hours ago* [-]

\76. I want my baby back baby back baby back baby back baby back baby back ribs.

Posted at 3:54PM on Aug 20th 2009 by Fat Bastard

lol

Jason404 1 point2 points 9 hours ago[-]

"Oh my God. This is horrible. Oh my God."

ROFL!

ohai 1 point2 points 9 hours ago[-]

I made myself lol.

stubble 0 points1 point 9 hours ago[-]

404 at 20:30 GMT - look like they got wind and did some patching

fullphaser 1 point2 points 9 hours ago[-]

On the other hand you just got a Sears IT Staff member fired, PROMOTIONS FOR EVERYONE !

evilpeter 1 point2 points 10 hours ago[-]

boo the party is over :(

jollynix 22 points23 points 10 hours ago[-]

TMZ picked up on this, and they think it's real:

http://www.tmz.com/2009/08/20/the-perfect-grill-for-a-cannibal/

Kyderdog 3 points4 points 10 hours ago[-]

Sears still exists?

Apostrophe_Detective 2 points3 points 10 hours ago[-]

That's not the only retarded thing they do. Do a "view page source" and you can see that they try to obfuscate their html with 336 lines of blank space.

BamBam-BamBam 3 points4 points 11 hours ago[-]

=( seems to be broken now.

DontHassleHoff 8 points9 points 11 hours ago[-]

nah... http://www.sears.com/shc/s/p_10153_12605_00301312000P

cowbey 4 points5 points 11 hours ago[-]

Thanks for the laugh!

cynoclast 3 points4 points 11 hours ago* [-]

I see this:

Looking for something at Sears.com?

Couldn't find it? Allow Our Personal Shopper Service To Assist You Click Here

You may have received this message for several reasons:

    * You have bookmarked our site, with a product that is no longer available. Thanks for coming back!
    * You tried to reach a page that no longer exists.
    * Your session may have timed out. To continue your visit, please proceed to Sears.com. If you are registered user‚ you will be asked to re-login to access the personalized features of the site.

If you reached this page from another Sears.com page‚ click to go back.

cynoclast 0 points1 point 11 hours ago* [-]

Totally didn't work for me.

I believe this is a RESTful site design.

And generally, people savvy enough to use REST already thought of XSS.

edit: can I get a screenshot of what it looks like when it works?

judicar 0 points1 point 10 hours ago[-]

I'm sure everyone else is just wrong.

sciolistse 6 points7 points 11 hours ago[-]

http://twitpic.com/eluly

cynoclast 0 points1 point 10 hours ago[-]

thanks!

IHAVENONAME 4 points5 points 11 hours ago[-]

Fun's over guys. Let's go home.

phildopus 4 points5 points 12 hours ago[-]

I just tried to change the breadcrumbs on another one, and it didn't work. I think the other ones that are still working just haven't been reset yet.

m1ss1ontomars2k4 4 points5 points 12 hours ago[-]

OK guys, the original one doesn't work, but some of the other ones in the comments work, so we're still safe.

roland19d 6 points7 points 12 hours ago[-]

Sears. Error - file not found.

D'oh. Reddit effect. Sears found out.

warning1 4 points5 points 12 hours ago[-]

I just got this visiting the OP's link.

Kaspersky Anti-Virus 6.0 for Windows Workstations Access denied The requested URL could not be retrieved

While trying to retrieve the URL:

http://www.sears.com/shc/s/p_10153_12605 _00922450000P?vName=Tools%20Yo&cName= Fucking%20Big%20Ass%20Saws&sName= Fuck%20Yeah&sid=I0084400010000100600&aff= Y

The following error was encountered:

The requested object is INFECTED with the following viruses: HEUR:Exploit.Script.Generic

Please contact your service provider if you consider it incorrect. Generated: 8/20/2009 12:22:49 PM Kaspersky Anti-Virus 6.0 for Windows Workstations

zeoslap 16 points17 points 12 hours ago[-]

http://www.sears.com/shc/s/p_10153_12605_04616922000P?vName=Appliances&cName=Corpse%20Storage&sName=Deluxe%20Corpse%20Freezer

Scarker 4 points5 points 12 hours ago[-]

What the hell? It says Error: File not found.

Voted down for weirdness.

Jayizdaman 2 points3 points 13 hours ago[-]

http://www.sears.com/shc/s/p_10153_12605_05771099000P?vName=Porn%20screens&cName=Big%20fucking%20Porn%20screens&sName=Mutha%20Fucka&sid=I0084400010000100600&aff=Y

bushwacker 2 points3 points 13 hours ago[-]

Although Sears has good tools at reasonable prices Home Depot is now selling Ridgid and Sears moved to some junk. Additionally as Sears are crooks when it comes to service, whether automotive or home repair I won't shop at their stores.

2oonhed 5 points6 points 13 hours ago[-]

Looking for something at Sears.com?

Couldn't find it? Allow Our Personal Shopper Service To Assist You Click Here

You may have received this message for several reasons:

* You have bookmarked our site, with a product that is no longer available. Thanks for coming back!
* You tried to reach a page that no longer exists.
* Your session may have timed out. To continue your visit, please proceed to Sears.com. If you are registered user‚ you will be asked to re-login to access the personalized features of the site.

If you reached this page from another Sears.com page‚ click to go back.

DrRocks 10 points11 points 13 hours ago[-]

NOOOO! It stopped working!

river-wind 1 point2 points 12 hours ago* [-]

the main links don't work, but the method still appears functional.

for instance, from unique616 above: http://www.sears.com/shc/s/p_10153_12605_07137404000P?vName=Hair+Trimmers&cName=Walk-Behind+Hair+Trimmers&sName=View+All

edit: retracted; the "working" links below are just cached. I can't force the columns to change by editing the url entere

toadkicker 5 points6 points 13 hours ago[-]

Looks like the found out!

malakon 5 points6 points 13 hours ago[-]

you naughty naughty silly little boy.

eguanlao 11 points12 points 13 hours ago[-]

It's over now. They fixed it. A few minutes ago, I saw it myself.

Apostrophe_Detective -1 points0 points 10 hours ago[-]

Nope. It still works on Kmart.com.

danjp 11 points12 points 13 hours ago[-]

http://www.sears.com/shc/s/p_10153_12605_00301312000P?vName=Porn%20Enablers&cName=Mobile%20Furtive%20Porn%20Machines&sName=Pedo%27s%20Preferred&sid=I0084400010000100600&aff=Y

visua 4 points5 points 14 hours ago[-]

That's almost as good as big ass fans.

sanfranman 7 points8 points 14 hours ago* [-]

Cease and dissist from Sears' lawyers in 3...2..

rmmead 6 points7 points 14 hours ago[-]

lol, that's awesome!

Sunk 9 points10 points 14 hours ago[-]

I love you.

hpymondays -3 points-2 points 14 hours ago[-]

I don't see what the problem is. So you enter nonexistent variables and their values through the url - nothing happens with them. What's the big deal?

BossTweed -1 points0 points 13 hours ago[-]

Nothing. Some people are easily amused.

ytknows 10 points11 points 14 hours ago[-]

Look at the breadcrumb. It is parsing them.

nailer 2 points3 points 12 hours ago[-]

Not any more.

hpymondays 2 points3 points 14 hours ago[-]

oh I see now. Still I don't see what's the big deal. It's not inserted into the database, it's just used for display of the breadcrumbs.

DontHassleHoff 4 points5 points 11 hours ago[-]

It WAS inserted into their cache database. That was the funny part.

One person did it but everyone else saw it... without having to include the replacement variables in the URL.

Happy_Man 15 points16 points 14 hours ago[-]

Except it's funny. What happened, your funny bone decided to take a vacation today?

hpymondays 0 points1 point 11 hours ago[-]

I did not find it funny. It looks like one person is amusing himself there with juvenile humor.

mikepixie 7 points8 points 13 hours ago[-]

Theres a Vulcan in every pack. Spock: "Your logic is unreasonable captain." Kirk: "It was a joke... lets get back to the ship. These plant poisons are making me laugh"

redditnoob 6 points7 points 14 hours ago[-]

18 inches? Fuck, mine isn't even 18 centimeters.

alclemon 10 points11 points 14 hours ago[-]

Finally, Sears is starting to cater to all of us that have no idea what a cutting band saw is, but know we want a saw the size of Volkswagon to cut some shit up.

PrawnSolo 6 points7 points 14 hours ago[-]

I think you made me drool a little...

hiicha 4 points5 points 14 hours ago[-]

Brilliant!

Mastrmind 6 points7 points 14 hours ago[-]

What about this: http://www.reddit.com/r/funny/comments/9cefy/SECRET_DOCUMENT_NUMBER_184917581_CLASSIFIED

crazybass 6 points7 points 14 hours ago[-]

I don't think it's very responsible to be showing secret documents like that.

alexBrsdy -2 points-1 points 14 hours ago[-]

thats cool, but same effect can be achieved by firebug

shamecamel 7 points8 points 14 hours ago[-]

Damn, it was never this badass when I worked there.

unique616 96 points97 points 14 hours ago* [-]

This is fun!

Here's another!

dronecrow 1 point2 points 10 hours ago* [-]

Mercedes H: Welcome to our Personal Shopper Service. My name is Mercedes H. How may I assist you?

you : yes

you : i was wondering how large this product was

you : http://www.sears.com/shc/s/p_10153_12605_07137404000P

you : it's like a gag gift, right?

you : hello?

The agent has lost internet connectivity.

you : ;(

ironiridis 2 points3 points 10 hours ago[-]

Could it be that the web lackies are working on this one? screenshot

Scarker 2 points3 points 12 hours ago[-]

They took down the saw, but left those up. Ha!

13ren 9 points10 points 13 hours ago[-]

Odd, the first one's not working, but the second one is...

When I edited the categories in the address bar, they weren't reflected in either. Maybe it's to do with caching.

unique616 3 points4 points 13 hours ago[-]

I had some trouble getting them to work at first, but I opened the links in FireFox & IE 7 and hit Ctrl + F5 a couple times and then they started working.

fnordmann 0 points1 point 14 hours ago[-]

These are much better than the submitted one. Haha!

Austin-G 15 points16 points 14 hours ago[-]

Agreed, your post actually made me laugh out loud.

demechman 6 points7 points 15 hours ago[-]

I have seen bigger.

knome 20 points21 points 15 hours ago[-]

never never never never trust user supplied information to be correct.

                                                                               never

Scarker 2 points3 points 12 hours ago[-]

That's like quadruple negative.

Fimbulfamb 0 points1 point 10 hours ago[-]

Quintuple, actually, counting that very last one.

seti32 5 points6 points 13 hours ago[-]

I think the problem is that some developers don't treat the URL or hidden fields as user supplied. Anything in the HTML should be treated as user supplied.

kaens 5 points6 points 13 hours ago[-]

I'm sure you mean "Any information being passed to the server", and not "Anything in the HTML".

Right?

seti32 1 point2 points 10 hours ago[-]

You're right, what I really meant was anything in the request. But I was trying to emphasize my point that developers may overlook that the product information was potentially changed by the user. Treating all HTML as user-malleable helps you cover this case.

LieutenantClone 0 points1 point 11 hours ago[-]

Same thing?

kaens 0 points1 point 11 hours ago[-]

I wouldn't think so. In the majority of cases, the majority of the HTML is going to be generated server-side, with very little of it changing based on user-supplied information. The HTML doesn't do anything but get sent to the client, and (again in the majority of cases) the info sent back from the client to the server isn't going to be HTML.

I'd actually say that if you're receiving HTML from the client, you're probably doing it wrong.

LieutenantClone 0 points1 point 10 hours ago[-]

Thats true, but its not what seti32 meant. I think he meant that the user is able to change anything in the HTML, including the parts of it that will get sent back to the server, like input fields. He was not very clear on what he meant though.

kaens 1 point2 points 10 hours ago* [-]

That's possible, but you're still only going to be validating things that get sent back to the server - and that's probably not HTML. Anything that gets sent back to the server should be treated as if it came from a user (because it did), anything that does not you can't really do anything about.

I was trying to clarify the point (and see if that's what he meant).

(I'm not the guy that went on the downvote spree for this thread, btw)

LieutenantClone 1 point2 points 10 hours ago[-]

Yea, I see what you mean. And of course, you need to validate everything, which includes the request headers if your using them for something special. Some programmers cant fathom how a user would change them, but its really not even very hard.

And its okay, some people just like their downvotes. Here, I will give you some upvotes to offset it! :D

phogasmic 1 point2 points 15 hours ago[-]

hahahahhahahha. Thats hilarious.

jruderer 21 points22 points 15 hours ago[-]

My favorite part was "Tools Yo"

zifnab966 20 points21 points 14 hours ago[-]

I'm far too amused at the concept of Sears having a "Tools, Yo" department.

cerealghost 46 points47 points 15 hours ago* [-]

For some reason many of the Tools categories are mixed up for me (using Chrome...)

My favorite is the garage door "openers".

iwdw 29 points30 points 14 hours ago[-]

Strictly speaking, you can use saws to open garage doors. Closing them afterwards might be an issue.

lastobelus -4 points-3 points 10 hours ago[-]

cool, you figured out why it's funny.

[deleted] 15 hours ago* [-]

[deleted]

danjayh 5 points6 points 15 hours ago* [-]

I thought it was funny.

EDIT: And for those of you who are worried that he may have wrecked it for the rest of us, this is the kind of thing that they can't fix and roll out overnight. Relax.

EDIT EDIT: Shit, I was wrong :'(. You cockbag, you ruined it for the rest of us! (FYI, it was a chat transcript with Sears support in which he sent a modified link to a rep and got the reaction ... original guy has deleted his post).

DEADB33F 5 points6 points 14 hours ago[-]

Would be quite simple to turn off caching though until they have a proper fix ready.

That way, the only way to end up on a page with a messed up category is via an altered link.

Johnnyping 10 points11 points 15 hours ago[-]

What is your deal man?

gingerchris 9 points10 points 15 hours ago[-]

BOOOOOOOOOOOOOOOOOOOOOOOOOO

IQuitRedditToday 5 points6 points 15 hours ago[-]

It's officially happened. reddit is now 4chan.

blhack 0 points1 point 8 hours ago[-]

what was it?

IQuitRedditToday 0 points1 point 8 hours ago[-]

It was a chatlog between a redditor and a Sears Representative. She became aware of the problem and he mentioned narwhals. Laughs all around.

colombian 18 points19 points 15 hours ago[-]

I hate you.

lnactive 65 points66 points 15 hours ago[-]

Tools yo, fucking big ass saws, fuck yeah.

jambajews 0 points1 point 11 hours ago[-]

Who let the dogs out?

puredemo 0 points1 point 9 hours ago[-]

Who would have thought that would be so complex to translate, geez.

dust4ngel 2 points3 points 12 hours ago[-]

That tool, saw big bum, so fuck fucking

stereomind 4 points5 points 13 hours ago[-]

here to saw the motherfucking wood yeah

bjmarley 7 points8 points 13 hours ago[-]

Are you talking to me?

damunzy 4 points5 points 14 hours ago[-]

My boy likes this translation:

http://translationparty.com/#2204574

beedee 20 points21 points 14 hours ago[-]

Using the UK English spelling

moparnut06 4 points5 points 15 hours ago[-]

You... ASS.

Scarker 2 points3 points 12 hours ago[-]

No, he saw an ass.

-Tyr- -4 points-3 points 15 hours ago* [-]

But... it's Sears. Who goes there anymore?

afokenr 5 points6 points 13 hours ago[-]

You obviously haven't heard of the Craftsman Unlimited Lifetime Warranty.

-Tyr- 4 points5 points 13 hours ago[-]

You obviously haven't seen the empty parking lot outside of every Sears in a Metropolitan area.
Seriously what's with the downvotes? I recently went to Sears to find a replacement part and I couldn't find a single employee that didn't walk away after making eye contact with me.
I do like Craftsman, the store itself just sucks.

DrRocks 3 points4 points 12 hours ago[-]

Ahh, well, I agree with you there.

afokenr 1 point2 points 11 hours ago[-]

I see your point as well. All I was saying is that there are still valid reasons to go there specifically. But then Craftsman hand tools aren't the only product they stock. They flog a lot of cheap crap too. The retail world has a few other options if you're into bad customer service or poorly manufactured bric-a-brac.

DrRocks 1 point2 points 10 hours ago[-]

I hear ya, I hated every minute of working there, and most of the stuff in the store is crap.

FarQueue 40 points41 points 15 hours ago[-]

That sounds like an xkcd "my hobby" comic.

jerschneid 34 points35 points 15 hours ago[-]

Sites like this make me feel better about myself as a web developer.

[deleted] 15 hours ago* [-]

[deleted]

jruderer 11 points12 points 15 hours ago[-]

Do you also go to concerts and ask security if they smell weed?

You should be banned from using a computer, ya friggin killjoy.

Redebo 10 points11 points 15 hours ago[-]

You idiot, you try to spoil the party but could not even do that right because you didn't even get him to confirm what he was reading.

You are the biggest loser in this post full of epic win.

[deleted] 15 hours ago* [-]

[deleted]

loki614 3 points4 points 15 hours ago[-]

The original putz deleted his post because he realized that he screwed up by almost ruining the exploit for everyone else. You failed worse. Did you really think this mediocre post was better than the fun that everyone else would have had making similar creative edits?

jeffkolez 4 points5 points 15 hours ago[-]

Did you take the survey?

davvblack 15 points16 points 15 hours ago[-]

You are the poopingest party pooper.

pudds 19 points20 points 15 hours ago[-]

Wow, that is terrible, TERRIBLE programming.

LieutenantClone -1 points0 points 11 hours ago[-]

Not really terrible, just really lazy.

cerealgriller 8 points9 points 15 hours ago[-]

Searched for Craftsman Professional 18 in. Wood and Metal Cutting Band Saw on Sears.com with Safari (I use FF) and it shows up the same. Lol that's pretty good.

JoSummertime 5 points6 points 16 hours ago[-]

This reminds me of all the amazon image abuse - although i'm loving how the DB is caching these.

exlex 163 points164 points 16 hours ago[-]

In case they change it, I grabbed a screen cap: http://imgur.com/3dP5Q.png

LunchTime 18 points19 points 12 hours ago[-]

Now this thread makes sense. They must have fixed it.

Moeri 31 points32 points 13 hours ago[-]

thanks, it doesn't seem to work for me...

damunzy 6 points7 points 14 hours ago[-]

I guess I am not the only only that was worried about that:

http://imgur.com/fYUgA.png

you_do_realize 0 points1 point 10 hours ago[-]

Hi. What Firefox theme is that?

khoury 2 points3 points 7 hours ago[-]

It's called "Red on gray makes my eyes bleed". Also known as "the goggles do nothing" theme.

cccmikey 7 points8 points 14 hours ago[-]

Thanks :) NoScript seems to prevent the custom categories from showing.

thepensivepoet 44 points45 points 16 hours ago[-]

You're a cool dude and I like you.

nickstl77 16 points17 points 16 hours ago[-]

Epic win, sir.

tehoreoz 25 points26 points 16 hours ago[-]

Saws scare me. I imagine myself dieing due to saw accidents anytime i think about saws.

why am I so fucked up

Scarker 2 points3 points 12 hours ago[-]

This is why you are afraid of Saw.

chzplz 3 points4 points 14 hours ago[-]

I remember in shop class a guy tried to sand a piece of balsa wood on a drum sander. I'm pretty sure he still doesn't have fingerprints.

IHAVENONAME 3 points4 points 14 hours ago[-]

Obligatory American Psycho chainsaw scene. I lost all my fear of chainsaws with it. Yes.. I know.. I'm weird.

ParanoydAndroid 4 points5 points 15 hours ago[-]

I think it's a symptom of having watched Final Destination in your youth.

Everytime I see some big ass tool hanging in a garage or somebody using a chainsaw, I construct a rube-goldberg machine in my head that makes death seem likely.

MonkeyWorldUK 1 point2 points 14 hours ago[-]

Cheated death recently?

Films can seriously screw you up when you're a kid; I watched the Truman show when I was younger. I spent the next few years of my life talking to the apex that joins the wall to my ceilings - thinking there was a camera there.

I think this is why I can't understand people's fears about CCTV and invasion of privacy. Since, as far as I'm concerned, all of you have watched my entire life up until now. How was it?

DrunkBeavis 3 points4 points 13 hours ago[-]

I'm glad I'm not the only one seriously affected by the Truman Show. I spent countless hours trying to figure out how my life could be an elaborate hoax like that.

MonkeyWorldUK 1 point2 points 13 hours ago[-]

Could have been the same with you, but I think it was a pretty major factor in my personality. And I like to think I've not turned out too bad.

All kids should be forced to watch the Truman show until they go asshat crazy, like in films where a person is strapped to a chair, have their eyelids forced open and are captively forced to watch some black and white mess about nukes or something.

This is what the world is missing.

dtrav001 14 points15 points 15 hours ago[-]

Oh no no your impulse is exactly correct, these things are terrifying and should be used with that in mind. I never run a chainsaw without being in a state of low-level terror of the thing, very healthy for preserving limbs.

basilisk 3 points4 points 13 hours ago[-]

A certain friend of mine sports a huge fancy scar on his neck, from a chainsaw that kicked back. I was there when it happened; it's a miracle he made it. I can't look at at one of those things without shivers running down my spine. A very useful tool, but damn, the accidents are nasty.

DrunkBeavis 5 points6 points 13 hours ago[-]

I've spent large amounts of time using a chainsaw, and i can definitely tell you that the fear is all that keeps you alive.

Try performing a plunge cut with a breaking into a cold sweat.

dtrav001 -1 points0 points 11 hours ago[-]

Drunk and basi; I was trying to resist telling this story, but I knew a kid with the skin on the inside of his left leg chewed up, it looked kneaded from mid-shin to mid-thigh. He said it was from a logging saw that he had already let go of the throttle on ... it was idling down when he ... well ... I guess wasn't afraid enough.

superrcat 6 points7 points 15 hours ago[-]

runs around in circles with a powered on chainsaw

dtrav001 5 points6 points 13 hours ago* [-]

No, it's more like, stands there in sweat of fear, trying to figure least likely way to sever flesh

telejon 29 points30 points 16 hours ago[-]

Saws, and the same goes for ice skates. I have never been ice skating because of the fear that I will fall and someone with razor sharp skates will come by and slice my fingers off. Haha, I am a god damn grown man and I am still scared of this.

dillikibilli 0 points1 point 9 hours ago[-]

My Dad sliced himself open with his ice skate when he was little - fell awkwardly and the skate blade caught his thigh and ripped open a nice gash. See, so you don't have to wait for someone else to come along and chop your fingers off, you can actually do it yourself! Feel better? :-)

mrhorrible 5 points6 points 14 hours ago[-]

The last time I was out-side, in 1923 I believe, I somehow got caught in a cotton-gin. I don't want to speak of it further.

sircrowbar 3 points4 points 14 hours ago[-]

I was considering trying to ice skate back in winter and kind of glad I didn't now. I went (roller) skating for the first time in years the other day and was amazingly poor at it and probably amazingly hilarious to watch. There'd probably be a betting pool to see how many fingers I lose by the end of my trials if it involved sharp blades on cold surfaces.

catsfive 13 points14 points 14 hours ago[-]

I am a Canadian. I played hockey most of my life... I was a goalie. One time in a game a player did just that to the inside of my knee—27 stitches. I saw my kneecap. There was no blood (until the hospital). I can honestly say I have been taken off the ice on a stretcher. Nice scar, now, though. Worth it for the experience...

zouhair 5 points6 points 14 hours ago[-]

How much did it cost for the hospital journey?

catsfive 0 points1 point 10 hours ago[-]

I was in Atlanta at the time. I had insurance, however, so it was free.

langer_cdn 4 points5 points 13 hours ago[-]

lol

tmoraca 12 points13 points 14 hours ago[-]

Dying: worth it for the experience

Scarker 2 points3 points 12 hours ago[-]

Too lazy to make the demotivational poster?

So it's come down to this.

tmoraca 5 points6 points 12 hours ago[-]

i do not hail from those annals of the webz. text is my weapon of choice. en garde!

mrhorrible 2 points3 points 9 hours ago[-]

Ah! You're using Bonetti's defense against me!

Jerp 10 points11 points 14 hours ago[-]

Life is an awesome game; it gives you exp when your character dies.

professorplumb 14 points15 points 13 hours ago[-]

Yeah but the respawn rate sucks.

Jerp 10 points11 points 12 hours ago[-]

The graphics make up for it.

tmoraca 3 points4 points 12 hours ago[-]

Game over, like forever, man

MonkeyWorldUK 5 points6 points 14 hours ago[-]

I always thought about that too, but I gave it a go anyway.

And sucked, I'm rather tall and top-heavy, which I think is just about the best sounding excuse. At one point, there was a little boy on a wheelchair being pushed around on the ice by his carer. Being myself, I fall right next to the boy, and accidentally kick his chair, sending him skating off to the other side of the rink.

I was then asked to leave. Oh, Cardiff!

freehunter 3 points4 points 15 hours ago[-]

Rollerblades me me afraid I or someone is going to snap their/my leg right in half, since the boot comes up not to the ankle like shoes and rollerskates, but halfway up the leg.

dilithium -1 points0 points 11 hours ago[-]

The only problem with that is your foot and ankle don't get to absorb shock so it goes to your knee. So if you do lots of jumping and stairs and stuff, you'll damage your knees. I was a hardcore rollerblader in the early 90s and there is nothing short of a car accident you could possibly do to break your leg in half at the boot. I'm sure it'd be awesome though.

MonkeyWorldUK 3 points4 points 14 hours ago[-]

If anything's going to break first, it'll be the plastic rollerblade, not the bone.

I hope anyway.

freehunter 2 points3 points 13 hours ago[-]

Man, I just reread my post. Halfway through a bottle of Jameson's isn't a good time to make a post. Hopefully this one comes out more coherent, even though I'm closer to the bottom. I wouldn't be so sure about the plastic breaking, I could very well imagine the plastic holding up well enough to at least fuck up your knees pretty bad.

MonkeyWorldUK 2 points3 points 13 hours ago[-]

Well, I'm no materials scientist, but there are some pretty bad ass plastics out there these days.

I think that last sentence is the key to identifying faux materials scientists actually.

But yeah, who are we to judge the stress and fracture rate of bone vs. plastic?

poco 6 points7 points 14 hours ago[-]

True story - picture someone standing in ski boots partly buried in snow. Now imagine someone shoving them in anger from behind. Knees don't bend that way.

shinybizarro 20 points21 points 15 hours ago[-]

I used to be afraid of invisible cars until I realized that it was probably the most irrational fear one could have. No, I'm not joking.

hopstar 1 point2 points 10 hours ago[-]

I used to be afraid of invisible cars until I realized that it was probably the most irrational fear one could have.

I don't think it's any more irrational than living in fear of an invisible deity who will send you to an invisible place called "hell" for failure to follow his rules.

digg_is_our_rival 29 points30 points 15 hours ago[-]

holy shit, i smirked at tehoreoz's post, but then i read yours, and it turns out i fear the same thing.

Scarker 9 points10 points 12 hours ago* [-]

holy shit, i smirked at both tehoreoz's and telejon's posts, but then i read your username, and it turns out i fear the same thing.

captainAwesomePants 3 points4 points 11 hours ago* [-]

holy shit, i smirked at all three of your posts, but then i read YOUR username, and it turns out i fear..umm...scarkers, I guess? Like maybe they're gang members with a shark and scarf motif? Man, I sure don't want to wear snorkels, flippers, and a knitted scarf in the wrong neighborhood at night.

Haddaway 0 points1 point 11 hours ago[-]

holy shit, i smirked at all four of your posts, but then i read YOUR username, and it turns out i fear awesome pants.

mrhorrible 0 points1 point 9 hours ago[-]

holy shit, i gave you a hamburger.

JoSummertime 0 points1 point 16 hours ago[-]

Not really, it's a very common symptom of OCD.

tehoreoz 0 points1 point 5 hours ago[-]

my life is a walking case of ocd :p

kmccormick 2 points3 points 13 hours ago[-]

... or, as we in the soft-sciences call it, the O.C. disorder.

ironiridis 1 point2 points 15 hours ago* [-]

... right. Being afraid of a very powerful tool ripping apart your limbs very very quickly and very very irreversibly is a symptom of obsessive compulsive disorder.

murder_turtle 0 points1 point 15 hours ago[-]

I have a sneaking feeling that you are being sarcasm.

BrokenEnglish 15 points16 points 15 hours ago[-]

I think you meant sarcasmic.

plan17b 3 points4 points 13 hours ago[-]

This is only true if they can experience multiple sarcasms

IAmHxC -3 points-2 points 16 hours ago[-]

How do you do this!

plat00n 4 points5 points 15 hours ago[-]

Dude, just look at the linked URL.

[deleted] 16 hours ago* [-]

[deleted]

thenextdosto 20 points21 points 16 hours ago* [-]

Sorry man, this sears page doesn't support braille.

EDIT : Sheesh, man, you didnt have to delete it, I was on a roll here.

ironiridis 9 points10 points 15 hours ago[-]

Don't worry. We know it was hilarious; we'll upvote you anyway.

racergr 8 points9 points 16 hours ago[-]

This used to work on this site as well. Anyone got any idea which CMS or other thingie is responsible for the bug?

poondigger 13 points14 points 14 hours ago[-]

bad programmers are responsible. Not a program or development tool.

Matt3k 6 points7 points 16 hours ago[-]

I would assume they are using software developed in house

game.co.uk is on .NET and sears on J2EE, so it's not the same software

superrcat 6 points7 points 15 hours ago[-]

So insightful, you are.

racergr 5 points6 points 16 hours ago[-]

Maybe, but it suffered from the same bug (before it was fixed). Kind of alarming to me. Although I'm not involved in web dev for a long time now so I don't know much about these devilish technologies:)

freehunter 5 points6 points 15 hours ago[-]

Back when I used GameFAQs, they had a similar thing for their error messages. The error screen would just parrot what was put in the URL.

Kalium 5 points6 points 15 hours ago[-]

This is a result of aggressively cacheing generated results without really validating that the results are meaningful. It's a design anti-pattern.

bassett 9 points10 points 16 hours ago[-]

I love messing with people using JS to edit webpages: javascript:document.body.contentEditable='true';%20document.designMode='on';%20void%200

Store it as a bookmark, then click it and you can edit the text of a page.

fnordmann 0 points1 point 14 hours ago[-]

With Opera you could simply "View Source", then edit and "Apply Changes".

alexBrsdy 2 points3 points 14 hours ago[-]

or use firebug

felixsapiens 1 point2 points 15 hours ago[-]

That is kinda cool... There's not any way to save it, is there?

insomniac84 0 points1 point 4 hours ago[-]

Print it.

sk31 -2 points-1 points 11 hours ago[-]

Well, you can File > Save As the results to your local computer, but save it back onto the website for every other visitor to see - no.

jamesburke 10 points11 points 16 hours ago[-]

go for the price ;-)

OtisDElevator 18 points19 points 16 hours ago[-]

...and stay for the URL entertainment.

Scarker 2 points3 points 12 hours ago[-]

What happens at Sears.com, stays at Sears.com.

scottshamus 7 points8 points 16 hours ago[-]

This is what some knowledge and a lot of boredom can do.

cunnilinguslover 34 points35 points 16 hours ago[-]

Can you change "Fucking Big Ass Saws" to "Narwhals"?

UnnamedPlayer 35 points36 points 14 hours ago* [-]

Here you go.

Edit: Doesn't work with NoScript for some reason. Chrome and IE showing it fine. :/

cunnilinguslover 7 points8 points 14 hours ago[-]

Thanks!

alex14 11 points12 points 14 hours ago[-]

Good product choice, FUCK YEAH!

harsenal 6 points7 points 17 hours ago[-]

=)

gfixler [S] 248 points249 points 17 hours ago[-]

It's worked all year. I hope any click-throughs from this post don't alert the web monkeys at Sears to patch it up, or all my fun would dry right up.

v13 0 points1 point 7 hours ago[-]

welcome to dry gultch

bitt3n 0 points1 point 9 hours ago[-]

weird, I couldn't get it to work on sears, so I tried kmart.com, but it turned it into a sears page. anyway, if anyone wants to buy a nuclear ostrich exploder, here you go:

http://www.kmart.com/shc/s/p_10153_12605_00823087000P

CatsAreGods 0 points1 point 10 hours ago[-]

Too late.

DontHassleHoff -1 points0 points 10 hours ago[-]

I saw what you did there.

river-wind 2 points3 points 12 hours ago* [-]

I think they may have pulled the specific items; the method still works, but the main link is borked.

edit:
retracted; the "working" links below are just cached. I can't force the columns to change by editing the url entered.

Jayizdaman 8 points9 points 13 hours ago[-]

It was fun while it lasted, nothing loads up anymore :(

freshtimes 26 points27 points 13 hours ago[-]

Apparently it's been patched up, or at least it's not working for me, now.

zifnab966 0 points1 point 11 hours ago[-]

Looks like they pulled the whole product page. It shows up in searches, but when I click on it it tells me it can't be found.

river-wind 2 points3 points 12 hours ago* [-]

The main link is not linger working but some of the subsequent above links are; link the Sear brand Baby Roaster above.

edit: retracted; the "working" links below are just cached. I can't force the columns to change by editing the url entere

DontHassleHoff 2 points3 points 12 hours ago[-]

You have to change the sName, vName, etc. BEFORE you load the link... so copy the original link to your clipboard, make the changes you want, THEN paste it in and load it. Otherwise you're forcing the cache to load the correct values before trying to insert your own.

blitzkrieg3 0 points1 point 8 hours ago* [-]

Thanks for this pearl of wisdom. It's thanks to you that I can post.

http://www.kmart.com/shc/s/p_10151_10104_00823160000P?vName=Penis+Vaginal&cName=Cock+and+Balls&sName=Grundle+Hair+Trimmers

For all you trying to get the click count up, this is not necessary. Just load it into the cache the first time and it will work. Just don't load it into the cache with the right values, because then they will be pulled from the DB instead of the page parameters

edit: and this: http://www.kmart.com/shc/s/p_10151_10104_004V090289831000P?vName=Fucking+Chicks&cName=Products+for+Pedos&sName=Chicks+I+Want+to+Fuck

It appears to be fixed on the sears.com side though :(

freshtimes 0 points1 point 10 hours ago[-]

So now clicking the reddit link just gives a 404.

minisunshine 5 points6 points 13 hours ago[-]

It is not working for me either.

myotheralt 0 points1 point 2 hours ago[-]

:( I missed all the fun of the broken things working wrongly.

levmyshkin 124 points125 points 13 hours ago[-]

Well, for when this is inevitably changed, I took a screenshot and mirrored it at Imgur. Here's a link:

http://imgur.com/kmt6w.jpg

ContentWithOurDecay 1 point2 points 3 hours ago[-]

Thanks, it wasn't what I saw earlier and I didn't really understand the submission.

iamdeirdre 24 points25 points 13 hours ago[-]

Thanks, they seem to have fixed it already!

DontHassleHoff 6 points7 points 12 hours ago[-]

Nope, all they did was reset the cache for that bandsaw. The trick still works on Sears.com AND KMart.com if you load up a new item.

tricolon 4 points5 points 4 hours ago[-]

Not anymore.

dcyli 3 points4 points 3 hours ago[-]

Confirmed.

Zeulodin 7 points8 points 15 hours ago[-]

I hope any click-throughs from this post don't alert the web monkeys at Sears to patch it up, or all my fun would dry right up.

This is an almost palpable explanation of the "the more people use a meme, the less funny it becomes" theory.

bobby_badass 12 points13 points 15 hours ago[-]

Coincidence?? I think maybe....

blitzkrieg3 3 points4 points 8 hours ago[-]

http://www.kmart.com/shc/s/p_10151_10104_011W574346110001P?vName=Pirates+Ninjas&cName=Amputees&sName=Its+a+fucking+pirate+hook

jessicalbarry 0 points1 point 8 hours ago[-]

cannot... stop... laughing

visua 9 points10 points 13 hours ago[-]

Yes the new Bad Ass Saw line hasn't really brought the return they had expected.

HereBeDragons 9 points10 points 15 hours ago* [-]

It might be a mistake to post it here. It's awesome and it's awesome now that I know... but I would've kept it to your friends if you wanted to save it.

But it's fucking funny. That's a fact.

NerdBot9000 16 points17 points 16 hours ago[-]

This literally made me laugh out loud. Now my office mate thinks I am a creepy villain.

girthagain 9 points10 points 15 hours ago[-]

Did you start out low and end up with a Skeletor-like cackle?

catsfive 5 points6 points 14 hours ago[-]

Untie me from these train tracks, sir!

msghmr 158 points159 points 17 hours ago* [-]

hahaaha, good find.

edit: The hell?! This link works too. What on earth have you done?!

edit2: Dude duuude dude dude. It appears to be listed that way in their database. Again, what have you done??

get_rhythm 0 points1 point 8 hours ago[-]

Doesn't seem to work anymore :(

get_rhythm -1 points0 points 8 hours ago[-]

Doesn't seem to work anymore :(

c130 5 points6 points 15 hours ago[-]

One more "dude" out of you and I'm gonna slap the shit outta you, ok?!

pHreaksYcle 0 points1 point 12 hours ago[-]

Now I'm trying to save you from yourself, but you gotta stop lettin yo momma dress you mannnnn!

furysama 3 points4 points 13 hours ago[-]

I'm the phreak -- phantom phreak!

pHreaksYcle 0 points1 point 12 hours ago[-]

-the king of Nynex?

toadkicker 4 points5 points 13 hours ago[-]

dude, chill!

BovineArmy 19 points20 points 15 hours ago[-]

This will not stand, ya know, this aggression will not stand, man.

catsfive 10 points11 points 14 hours ago[-]

Man, that rug really tied the room together.

dorkasaurus 7 points8 points 13 hours ago[-]

Fuckin' A.

emocalypse 4 points5 points 14 hours ago[-]

The Dude abides.

sciolistse 112 points113 points 16 hours ago[-]

Nah, no need to be alarmed for the sake of their database, though it does up the hilarity factor.. They run a cache on products that have been accessed several times, and the linked product wasn't at the time cached with their correct values. After hitting the link a few times, the supplied values were entered into their cache, and now, that's what it'll have until it drops or heads start rolling.

You can try it with any other product if you feel you have a contribution to make to the Sears website.. I just went through misspelling some names..

DontHassleHoff 9 points10 points 12 hours ago* [-]

And if they fix it on Sears, it also works on KMart.com:

http://www.kmart.com/shc/s/p_10151_10104_024W387519110001P

edit: they reset the cache on the first one... fixed to a new link

DontHassleHoff 1 point2 points 10 hours ago[-]

http://www.kmart.com/shc/s/p_10151_10104_1990000000381395P

foocs 0 points1 point 11 hours ago[-]

It sure does! I just found a great deal on baby cages! http://www.kmart.com/shc/s/p_10151_10104_04913908000P

DontHassleHoff 23 points24 points 11 hours ago* [-]

You are now speaking with Dustin E.!

Dustin E.: Welcome to our Personal Shopper Service. My name is Dustin E.. How may I assist you?

you : I'm looking at a baby seat and your site calls it a "baby launcher"

you : Will it actually launch my child out of the seat?

you : http://www.kmart.com/shc/s/p_10151_10104_3590000000006779P

Dustin E.: Good morning! As your Personal Shopper, I will be happy to look into this inquiry for you. Our goal is to be the one-stop solution for all your needs.

Dustin E.: Are you looking for an item that will launch your baby?

you : Yes. But only when he is naughty.

Dustin E.: Well, I looked up the item that you linked, but I only found a baby sleeper chair.

Dustin E.: Can I get the name of the item you are looking at specifically please?

you : The link is above. Right above the name of the item it says "BabyBaby Flight Devices > Baby Launchers"

you : Will it launch him and if so, how far?

you : I would like something that can send him at least 20 feet across the room or optionally into a velcro wall.

Your chat has ended. Thank you for speaking with us.

ohstrangeone 1 point2 points 3 hours ago[-]

Pretty sure they fixed it :(

saranowitz 8 points9 points 12 hours ago[-]

nm, it does!

http://www.kmart.com/shc/s/p_10151_10104_04911583000P?vName=Alien+Saucers&cName=Death+Crafts&sName=Laser+Beams&sid=S-on-Kx20k061224x0000002

theillustratedlife 0 points1 point 9 hours ago[-]

Yours works, but mine doesn't. =(

http://www.kmart.com/shc/s/p_10151_10104_015W101732110001P?vName=Fragrance&cName=Aphrodisiacs&sName=Gay+aphrodisiacs

node_n 0 points1 point 9 hours ago[-]

Alien Saucers Death Crafts > Laser Beams Share This Item Print

I seriously didn't know they carried these at Kmart. lol

saranowitz -1 points0 points 12 hours ago[-]

No, doesn't seem to:

http://www.kmart.com/shc/s/p_10151_10104_9990000010875211P?vName=Baby+Execution&cName=Death+Saucers&sName=Dangling+Spike+Impalers

DontHassleHoff 1 point2 points 12 hours ago[-]

Sure it does. Reload your page a few times, I see your mods:

http://www.kmart.com/shc/s/p_10151_10104_9990000010875211P

roland19d 10 points11 points 12 hours ago[-]

or heads start rolling

I know where you can get a big-ass saw to do that. Or big ass-saw. Whatever.

clayy93 -1 points0 points 4 hours ago[-]

So that's you're hobby too I guess.

hiffy 9 points10 points 14 hours ago[-]

They run a cache on products that have been accessed several times, and the linked product wasn't at the time cached with their correct values.

Why on earth are they caching the product categories accessed over browser params? Something hella fishy is going on.

takeda64 1 point2 points 9 hours ago[-]

They most likely use reverse proxy such as Varnish and there's obviously a buggy code.

The buggy code generates the incorrect output and the cache simply caches it to take the load of the web server.

ultramancool 0 points1 point 10 hours ago[-]

Perhaps it's caching the built page so it can later be reused when you hit the normal url.

visua 5 points6 points 13 hours ago[-]

Agreed. I don't understand what the developer was doing?

loki_racer -1 points0 points 11 hours ago[-]

I would guess that by passing this data in the url, they remove the table that stores those category names from the query needed to render the page.

Yes this is more "efficient" but if you are already doing page level caching, doesn't that completely remove the need for sql tuning of this caliber?

hiffy 4 points5 points 13 hours ago[-]

I guess the big WTF sign is that the breadcrumbs are populated by the URL params in the first place.

I can't imagine why you would ever do that. Are there Sears products in multiple categories?

DontHassleHoff 4 points5 points 12 hours ago[-]

Yes. Instead of relying on cookies (which, of course, a small % of users do not receive) they are using the URL to determine how you got to a certain product. You're right in that it is a disambiguation of what category you came from since products can exist in multiple categories.

ObligatoryResponse 3 points4 points 14 hours ago[-]

After hitting the link a few times, the supplied values were entered into their cache, and now, that's what it'll have until it drops or heads start rolling

Except nobody uses the direct product links. If you browse, you're given the proper categories, and if you search you get your terms from your query instead of the proper categories (ex: Tools Search "craftsman professional band saw" > Bench & Stationary Power Tools > Band Saws). So no heads will roll because nobody will ever see it.

maxd 14 points15 points 14 hours ago[-]

If you SEARCH, however, you will still see Tools Yo > Fucking Big Ass Saws > Fuck Yeah.

Item six on this page.

ObligatoryResponse 5 points6 points 13 hours ago[-]

Whoops. You're right. I had chosen the wrong 18" band saw. Even if you browse, you end up with this link and are given the cached names. Heads might roll after all.

maxd 4 points5 points 13 hours ago[-]

Weird, when I try to browse for it the final link is invalid.

ObligatoryResponse 9 points10 points 13 hours ago[-]

That's because heads did roll and they deleted the item. Gfixler's link is down, too.

sciolistse 2 points3 points 13 hours ago* [-]

I actually wasn't serious about the head-rolling.. And yeah, they seem to have hidden the product in Gfixler's link unfortunately.. The actual bug seems to be working without a hitch for yet another few minutes.

Cleydwn 0 points1 point 10 hours ago[-]

Either that or the SQL injection trick worked.

adc 3 points4 points 14 hours ago[-]

I got the modified categories by navigating to the band saw via the search bar.

DontHassleHoff 24 points25 points 14 hours ago[-]

It is baffling that someone smart enough to write a caching routine is dumb enough to use tainted user input to fill it.

XduckyX -2 points-1 points 12 hours ago[-]

And stupid enough to use $_GET to populate things...

takeda64 0 points1 point 9 hours ago[-]

What makes you think they use PHP?

XduckyX 0 points1 point 8 hours ago[-]

Are variables passed through the address bar not called $_GET veriables in all languages of the web?

takeda64 0 points1 point 5 hours ago* [-]

Nope. The HTTP has GET and POST requests, though $_GET and $_POST is a PHP thing. Many languages don't even use $ in front of their variables, not to mention the underscores. Actually in many languages underscores (or double scores, then single are for users to mark private variables) are used for internal stuff that generally shouldn't be used by user. PHP has its own conventions.

Edit: Damn markdown and underscores.

BiggerBalls 3 points4 points 11 hours ago[-]

Using $_POST wouldn't be much better.

ScientificAffairs -1 points0 points 11 hours ago[-]

It'd make it less obvious to the untrained eye

BiggerBalls 2 points3 points 11 hours ago[-]

Security through obscurity is not security.

krelian 0 points1 point 10 hours ago[-]

So what's your password?

BiggerBalls 1 point2 points 9 hours ago[-]

password.

keziahw 8 points9 points 13 hours ago* [-]

That data shouldn't need to be cached - their process:

  1. Server looks up category names from db

  2. Server include category names in links

  3. Client requests page address that includes category names

  4. Server reads category names from client request

  5. Server includes category names from client in page

Sane process:

  1. Server looks up category names from db

  2. Server include category names in links

  3. ???

  4. PROFIT

edit: line breaks

mrcmnstr 0 points1 point 49 minutes ago[-]

We won't stop 'till we have underpants, yum yum, yummy yum hey! http://www.slhacker.com/downloads/217_gnomesong.wav

DontHassleHoff 5 points6 points 13 hours ago[-]

Oh I can't argue with you there. They were smart enough to write a caching routine but not smart enough to know they don't really need it.

They're smart enough to strip out any attempt at putting <script> or <img> tags into the categories (I've tried...) but dumb enough to display the categories on the screen from the GET.

Baffling.

andrewcooke 0 points1 point 4 hours ago[-]

they're probably just caching generated page by url. see below for discussion of why they are generating breadcrumbs from urls.

chimpout 3 points4 points 15 hours ago[-]

Someone tell me why this isn't working :(

http://www.sears.com/shc/s/p_10153_12605_00953985000P?vName=You%20Lazy%20BastardName=Get%20out%20of%20your%20carName=LEGS%20YO

ninjai 40 points41 points 13 hours ago[-]

http://www.sears.com/shc/s/p_10153_12605_07117638000P?vName=Human+Cooking&cName=Grills+to+Cook+Babies+and+More&sName=Body+Part+Roaster

BunjiX -1 points0 points 11 hours ago[-]

Needs upvotes due to todays only LOL.

saranowitz 77 points78 points 12 hours ago* [-]

Welcome!

Please wait while we contact the next available agent...

This chat may be monitored or recorded for quality assurance purposes.

To ensure proper servicing, please do not close this window until your chat is completed. Thank you!

You are now speaking with Myra J!

Myra J: Welcome to Sears. My name is Myra J. How may I assist you?

you : hi there

you : i am concerned about a link on sears' website

you : http://www.sears.com/shc/s/p_10153_12605_07117638000P?vName=Human+Cooking&cName=Grills+to+Cook+Babies+and+More&sName=Body+Part+Roaster

you : is this a joke?

Myra J: We are working on this.

you : the category says "human cooking > Grills to cook babies and more > Body Part Roaster"

Myra J: Someone is hacking in to our computer system

Myra J: I apologize sincerely.

you : but i dont understand why sears allowed that

Myra J: Sears isn't allowing this. We are trying to get it fixed.

Myra J: Anything else I can do for you?

you : Do you have any grills that can actually be used to cook body parts?

Your chat has ended. Thank you for speaking with us.

DontHassleHoff 1 point2 points 11 hours ago[-]

The beauty is that we're not actually hacking into anything, just loading a page.

ultramancool 1 point2 points 10 hours ago* [-]

We could have changed the GET request to include an SQL injection attack to drop all their products too (well, if they were vulnerable, point being, it's 'just loading a page'). We found a vulnerability in their script, we're exploiting it.

r3m0t 0 points1 point 11 hours ago[-]

Actually, in popular language the word "hacking" covers any unauthorised use of a computer system. If you connect to an open wireless network that you aren't authorised to use, that's hacking in the eyes of the law.

geebs61 9 points10 points 10 hours ago[-]

Well, then the law is wrong.

khoury 2 points3 points 7 hours ago[-]

Growing up is realizing that right and wrong don't really matter. It's a sad world we live in.

Suppafly 9 points10 points 12 hours ago[-]

most of links posted havent worked, but that one did. hilarious.

zaneyard 2 points3 points 13 hours ago[-]

That's hilarious.

judicar 3 points4 points 13 hours ago[-]

Wow, that actually goes into the cache too ...

cosmo7 2 points3 points 13 hours ago[-]

Sid is dead.

darkerside 3 points4 points 14 hours ago[-]

you're also missing the & between your parameters

mjhall 11 points12 points 15 hours ago[-]

It only works when the page is generated, subsequent views see cached pages which is why the link without the fake names works; if you wanted to change something you'd have to find a link to an item that's not cached and set the fake names before it's viewed.

Apostrophe_Detective 4 points5 points 11 hours ago[-]

Cool. Thanks for the tip. Here is what I bought today:

http://www.kmart.com/shc/s/p_10151_10104_15000000000C6041P?vName=stuff&cName=More+Stuff&sName=Dead+Cats+In+A+Sack

chimpout 6 points7 points 14 hours ago[-]

Thanks to both of you

Artmageddon 3 points4 points 14 hours ago[-]

Dude it comes up now... the name length goes outside of the graphic bounds though. I'd put up a screen shot but all image hosts are blocked from work :(

DEADB33F 8 points9 points 12 hours ago[-]

try... http://208.43.146.85/

Spaceman_Spliff 0 points1 point 11 hours ago* [-]

[----?----]

DEADB33F 0 points1 point 10 hours ago[-]

You might find that simply manually setting a DNS server rather than relying on the one assigned by your DHCP host will fix it.

Some poor quality filters work by resolving blacklisted domains to an internal web server (rather than an external IP address) which serves up a 'this page is blocked' page.
Using an external DNS server to resolve the domains should fix it if that's the case.

Artmageddon 14 points15 points 12 hours ago* [-]

Wow, websense only blocks domain names, not the actual IPs.. I learned something today :D

memmek2k 12 points13 points 15 hours ago[-]

It's vName, cName and sName, not just Name.

xAnarkix 61 points62 points 15 hours ago[-]

So what happens if you rename it to

     Saw'); DROP TABLE Tools;--

?

pizzmeharder -2 points-1 points 11 hours ago[-]

As long as you insert a question mark, you can put anything after any url.

http://www.reddit.com/r/funny/comments/9cefy/before_i_show_friends_things_im_considering/?fucklotsofhardthrobbingcock

diminoten 8 points9 points 13 hours ago[-]

I'd love it if all of their tools to be stored in a table called "tools", the appliances in a table called, "appliances" etc.

There'd be a secret table called, "sex_toys", but only for loyal Sears customers. :-)

Smoogy 0 points1 point 7 hours ago[-]

I'm calling sears today: "Hi, I'd like to buy the sex table you're advertising"

BiggerBalls -1 points0 points 11 hours ago[-]

If the above SQL injection works, you could probably just add it to their catalog for them.

Malcorin 14 points15 points 12 hours ago* [-]

You possess the remarkable gift of turning a discussion about category descriptions and woodworking saws into a discussion about sex toys.

Congratulations.

bjupton 8 points9 points 12 hours ago[-]

What, these aren't the same things already?

Altoid_Addict 0 points1 point 12 hours ago* [-]

Indeed

Mad_Gouki 15 points16 points 12 hours ago[-]

screw, power drill, hammer, dildo.

acornwa 21 points22 points 11 hours ago[-]

When the only tool you have is a dildo, everything starts to look ready to nail.

plbogen 5 points6 points 12 hours ago[-]

Can't forget the planer.

cynoclast 0 points1 point 11 hours ago[-]

For.....shaving?

barashkukor 3 points4 points 14 hours ago[-]

I really wish I knew wtf you were talking about.

stubble 0 points1 point 9 hours ago[-]

oooh look -----> comics..

rickf71 20 points21 points 14 hours ago[-]

Can't let that go by without mentioning this.

gbeier -2 points-1 points 14 hours ago[-]

http://xkcd.com/327/

adc 14 points15 points 14 hours ago[-]

SQL Injection

Armitage1 26 points27 points 14 hours ago[-]

Yeah, Go ahead and try that. I would do it myself, but I'm too busy doing other things that wont get me arrested by the FBI.

SmokeInTheTrees 37 points38 points 14 hours ago[-]

And I'm too busy doing other things that WILL get me arrested by the FBI.

Yorn 57 points58 points 14 hours ago[-]

http://www.bash.org/?88575

Redmoons 0 points1 point 3 hours ago[-]

I want this to be real so badly.

generic_login 0 points1 point 3 hours ago[-]

every time I see that I wonder if it's real. That is faked, right?

FBI_John 4 points5 points 2 hours ago[-]

Yes it is. it IS faked.

there's nothing to see here... move along...

generic_login 1 point2 points 1 hour ago[-]

Damn you! now i'm even more confused!

funkytaco 7 points8 points 8 hours ago[-]

That reminds of this time that the FBI really was onsite where I worked (a data center).

We were shutting down a pedophilia website, so a co-worker went into the chat saying that the FBI was shutting down the site. Then we pulled the plug.

I'm sure there were a couple stained chairs after that.

Arttherapist 10 points11 points 2 hours ago[-]

I'm sure there were more than a couple of stained chairs before that.

loiosh01 16 points17 points 10 hours ago[-]

TMZ ruined it for you http://www.tmz.com/2009/08/20/the-perfect-grill-for-a-cannibal/

sciolistse 21 points22 points 15 hours ago* [-]

I have a hard time seeing that those values are getting sent to their database.. (Not that it wouldn't be great)

stubble 0 points1 point 9 hours ago[-]

Yea I think SAP probably calls it something really really obscure anyhow

zeabrid 15 points16 points 16 hours ago[-]

I can't believe that works. Wow.

DarkQuest 47 points48 points 16 hours ago[-]

Oh wow, I think we've just discovered a new class of XSS! Go reddit!

benihana 23 points24 points 15 hours ago[-]

It's like XSS without all the damage and legal issues. Quite possibly the perfect customization.

DEADB33F 12 points13 points 13 hours ago[-]

That depends.

Has anyone tried injecting a <script> element via the url query text?
If that's possible you could have a page inject an offsite javascript file. The sears page will cache the breadcrumbs for anyone who subsequently views the page.

The offsite JS could grab the users session cookie, or perhas more maliciously it could create a virus which appends its <script> tag to every link on the page.

Eventually once enough pages have been cached including the <script> breadcrumb it'll be next to impossible for anyone viewing the site not to stumble across an infected page and then propagate it to yet more pages.

So yeah, if the input is in fact unsanitised it'd be quite easy to set up some form of phishing attack using this vector.

DontHassleHoff 6 points7 points 12 hours ago[-]

Yea I did try urlencoded <script> and <img> tags (for CSRF, etc) and any time a tag is passed inside of a category, the site forwards you to the home page... so they are scrubbing the data but still allowing you to insert plaintext.

heyimfromdiggbenice 14 points15 points 12 hours ago[-]

THANKS FOR THE INSTRUCTIONS DEADB33F

Captain_Haddock 6 points7 points 16 hours ago[-]

It appears to be listed that way in their database.

HA HA HA OH WOW

curmudgeoncat -2 points-1 points 16 hours ago[-]

he seems to be the the web monkey at Sears

[deleted] 15 hours ago[-]

[deleted]

sciolistse 3 points4 points 15 hours ago[-]

I don't know where he works, but that's not the reason for you not being able to change it back.

willis77 23 points24 points 16 hours ago[-]

How the. What the. I don't. Say whaaa?

Tgg161 9 points10 points 16 hours ago* [-]

Looks like no matter how I navigate to that page, the breadcrumbs are set that way for that one tool, but it hasn't effected other band saws.

I couldn't figure out how to do this for other tools.

dalore 12 points13 points 15 hours ago[-]

sciolistse nailed it: http://www.reddit.com/r/funny/comments/9cefy/before_i_show_friends_things_im_considering/c0c8eaw

Just get a page loaded a few times and it saves it in the cache for that product id.

Primar 19 points20 points 16 hours ago[-]

Haha, that might just be the best thing ever.

ajgiles 10 points11 points 17 hours ago[-]

Yes gfixler, what have you done?

Use of this site constitutes acceptance of our User Agreement and Privacy Policy. (c) 2009 Conde Nast Digital. All rights reserved.