full-disclosure - New (19.10.05) MS-IE Url Spoofing bug (byK-Gen)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri Oct 21 19:21:36 2005
From: gautam.bipin at gmail.com (Bipin Gautam)
Subject: New (19.10.05) MS-IE Url Spoofing bug (byK-Gen)

On 10/21/05, Jake Cole <jakecoleus@...oo.com> wrote:
> In "Billy's" defense, this is expected in most
> JavaScript-enabled browsers.
>
> Here's a Firefox version:
>
> <a href="http://microsoft.com"
> onClick="window.setTimeout('document.write(unescape(\'%3cscript%3ewindow.location=%27http://google.com%27%3c/script%3e\'))')">Microsoft</a>
>


I really don't know what to EXACTLY call it... yap it can be used in
PISHING; cauz a few weeks back I was thinking this  EXACT same thing.
GOT the idea from 'http://vmyths.com/' ither is a page(news pade i
guess) there its sectioned and two different websites are displayed.
(O;
--

Bipin Gautam
http://bipin.tk

Zeroth law of security: The possibility of poking a system from lower
privilege is zero unless & until there is possibility of direct,
indirect or consequential communication between the two...