Uncovering TinyUrls’ True Origin

by Sep 21, 2017

URL shortening is great for Twitter messages but hides the origin. Would you really trust http://bit.ly/e0Mw9w?

Here is a simple approach that lets you uncover where a tiny URL really points to:

$shortUrl = "http://bit.ly/e0Mw9w"

$longURL = Invoke-WebRequest -Uri "http://untiny.me/api/1.0/extract?url=$shortUrl&format=text" -UseBasicParsing |
                Select-Object -ExpandProperty Content

"'$shortUrl' -> '$longUrl'"

As it turns out, the tiny URL in this example points to Lee Holmes blog: http://www.leeholmes.com/projects/ps_html5/Invoke-PSHtml5.ps1. Lee Holmes is a PowerShell team member, and if you trust him, you could now be intrigued to run his famous piece of code:

iex (New-Object Net.WebClient).DownloadString("http://bit.ly/e0Mw9w")

It’s a great example of how dangerous it can be to run Invoke-Expression (alias “iex”).

Twitter This Tip! ReTweet this Tip!