httpwebwitch - 9:30 pm on Apr 16, 2009 (gmt 0)

This discussion is straying away from inter-site linking, and all over URL discovery... but here are a few more

URLs discovered in any other HTML attributes, like
<img onerror="http://www.example.com" lowsrc="http://www.example.com"/>

for a full list of all possible ones, just take a look at the HTML DTD
<table background="http://www.example.com">
<iframe src="http://www.example.com">
<base href="http://www.example.com"/>
... and many more
(incidentally, all of these can also be targets for XSS, but that's another topic)

URLs inferred by parentage:
http://www.example.com/dir/image.gif => http://www.example.com/dir/

URLs used in CSS:
body{background:url('http://www.example.com/image.gif');}

URLs used in conversation via Instant Messaging and Chatrooms (assuming suspiciously that they are not very private)

Tweets and statuses and other user-entered content all over the www

brute-force scraping of tinyUrl et al

the URL set as your "home page" in your browser

*your* Browser History (yes, it is possible to scrape it using some nifty and unobtrusive JS+CSS techniques)