full-disclosure - Is there a 0day vuln in this phisher's site?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41FCA799.6010000@doxdesk.com>
From: and-bugtraq at doxdesk.com (Andrew Clover)
Subject: Is there a 0day vuln in this phisher's site?

Paul Kurczaba <seclists@...urinews.com> wrote:

> After some research, I found the script "exploit(s) an
> Internet Explorer vulnerability resulting in Internet Explorer displaying
> one location in the Address bar, but actually loading the content from a
> different site."

Yep, this is a straight copy of my example posted here:

   http://www.doxdesk.com/personal/posts/bugtraq/20030713-ie

I have seen a few other phish in the wild using this exploit too.

I'm alarmed to see this still works in IE6SP2, as Microsoft fixed most 
of the problem in one of the SP2 betas, by limiting createPopup windows 
to the windows work area. Evidently they reversed the fix for the final 
SP2 release. SP2 is safe from the issue where popups can appear over 
dialogs, but it seems it is still vulnerable to spoofing everything 
else. Great.

-- 
Andrew Clover
mailto:and@...desk.com
http://www.doxdesk.com/