full-disclosure - Is there a 0day vuln in this phisher's site?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <lwo10fabmwuqmur.300120050743@shayndel>
From: larry at larryseltzer.com (Larry Seltzer)
Subject: Is there a 0day vuln in this phisher's site?

>>Yep, this is a straight copy of my example posted here:
>>http://www.doxdesk.com/personal/posts/bugtraq/20030713-ie
>>I have seen a few other phish in the wild using this exploit too.

So have I. Not to diminish the importance of the attack, but this
assumes the default placement of Address Bar if I'm not mistaken, so if
the user changes their toolbar layout the popup will give itself away,
correct? 

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@...fdavis.com