Interesting bug aka potential Google Search exploit write up by Tom Anthony, Head of R&D at Distilled.
*
$1337 Google bug bounty for security exploit that influences search results [tomanthony.co.uk]
Note: in typical Google geekiness the odd 1337 dollar amount is tribute to 'leet' hacker.
Google provides an open URL where you can ‘ping’ an XML sitemap which they will fetch and parse – this file can contain indexation directives. I discovered that for many sites it is possible to ping a sitemap that you (the attacker) are hosting in such a way that Google will trust the evil sitemap as belonging to the victim site.
On reading I found myself considering several similar channels of investigation - however, as I have neither the time nor interest in G will leave such to others. :)
Warning: always consider risks and ramifications before playing.
