Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Using HTTP referer for phishing attacks
From: xD 0x41 <secn3t () gmail com>
Date: Wed, 25 Jan 2012 21:34:15 +1100

hrm now thats indeed of interest... good to point out...thx.


On 25 January 2012 21:09, Jerome Athias <jerome () netpeas com> wrote:
This could be also used in some cases to Refer requests from "paypal" or
such payment systems when there is no/bad validation checks on an
e-commerce website.

ie:
if(Referer.Contains("paypal.com"))
{ ok }

but what if i control "mypaypal.com"?


Le 24/01/2012 20:14, Jan Wrobel a écrit :
Hi,

Sorry if this is not new, but I didn't manage to find any mention of
such a technique.

In short: HTTP referer field contains information where the web user
is coming from, which is often a trusted site such as a web search.
Having such information, a malicious web site can use several tricks
to fool the user into thinking that he or she returned to the
referring site. In fact, the user is taken to a generic phishing site
that intercepts all data exchanged between the user, the referring
site and sites visited from the referring site.

More detailed write up with few examples is here:
http://mixedbit.org/referer.html

Cheers,
Jan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


--
Jerome Athias - NETpeas
VP, Director of Software Engineer
Palo Alto - Paris - Casablanca
www.netpeas.com
---------------------------------------------
Stay updated on Security: www.vulnerabilitydatabase.com

"The computer security is an art form. It's the ultimate martial art."


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault