<div>I thought this was by design since you may have a known url to go to but only after some form of validation has been passed.</div>
<div><br><br> </div>
<div><span class="gmail_quote">On 10/20/05, <b class="gmail_sendername">K-Gen Gen</b> <<a href="mailto:alphakgen@gmail.com">alphakgen@gmail.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">New (19.10.05) MS-IE Url Spoofing bug (by K-Gen).<br><br>Gr337s .. I (K-Gen) have found a new (I think..) URL spoofing bug in IE.
<br><br>Affected : All MS-IE Browsers (Win XP SP2 as well).<br><br>This allows a malicious website to host a specially crafted A HREF tag<br>that shows to the user<br>as a link to one location, but actually redirects to another. This can
<br>be used in Phishing scams<br>and other malicious attacks.<br><br>The basic idea here is to write a geniune <a href=""> </a>tag but<br>include an onClick event handeler<br>that will redirect (window.location=
"";) to another page. The next<br>example won't work:<br><br><a href="<a href="http://microsoft.com">http://microsoft.com</a>"<br>onClick="window.location='http://google.com';">Microsoft</a>
<br><br>Probably there is some protection in IE .. but not enough :)<br><br>If we try the next thing:<br><br><a href="<a href="http://microsoft.com">http://microsoft.com</a>" onClick="alert()">Microsoft</a>
<br><br>An alert WILL pop-up before redirecting. The same thing will happen to<br>the document.write("");<br>method, it will execute before redirection.<br><br>Hence, the next Proof of Concept:<br><br><a href="
<a href="http://microsoft.com">http://microsoft.com</a>"<br>onClick="document.write(unescape('%3cscript%3ewindow.location=%27http://google.com%27%3c/script%3e'))">Microsoft</a><br><br>Put the code into an HTML page and see for yourself. In the status bar
<br>and in the properties the<br>link appears as <a href="http://microsoft.com">http://microsoft.com</a> , but if you click on the link it<br>will redirect you to<br><a href="http://google.com">http://google.com</a> .<br>
<br>I used unescape becuse characters like < > and ' cause run-time errors...<br><br>This is not extremely critical as the old %01@ bug (That still works<br>on my IE sp1 :lol:), becuase<br>It does not obscure the real link in the Address bar, but i bet there
<br>will be a PoC for this one too, sooner or later...<br><br>Have a Nice Day.<br>K-Gen<br>_______________________________________________<br>Full-Disclosure - We believe in it.<br>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">
http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/</a><br></blockquote></div><br>