<br><br><div><span class="gmail_quote">On 2/19/07, <b class="gmail_sendername">Juergen Fiedler</b> <<a href="mailto:juergen@fiedlerfamily.net">juergen@fiedlerfamily.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
you can't readily get to the source<br>code for the form action because it is done in some sort of server<br>side scripting (CGI, PHP, ASP, whatever...) that can't readily be<br>viewed from the client side.</blockquote>
<div><br>
Can't readily be viewed BUT that part is sort of not-the-problem.<br>
<br>
Those obvious server-side scripts Juergen mentioned would most probably
consist in a MVC-like design with persistence function code storing
collected data the simple way: in clear text... Since those fine
illegal gentlemen ain't gathering someone's Internet banking passwork
in order to encipher them and protect them from this <span class="descricao">bloodthirsty </span>world...<br>
<br>
Thus, concerning traditional phishing sites, the code itself is not really an issue.<br>
Code starts being problematic by the moment potential damaging load-time scripts -- say AJAX techniques -- spread.<br>
</div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">That said, I have run into one or two phishers who compromise a site<br>(or create a throwaway site themselves), upload their scripts in a
<br>tarball, install them - and then leave the tarball around for<br>posterity to analyze. I kid you not.<br>Unfortunately, the only good way to get to that source code is by<br>asking the administrator of a compromised site whether they found
<br>anything that they would be willing to share; going in and poking<br>around yourself may put you into a legal position that you'd rather<br>not be in.<br><br>HTH,<br>--j<br><br>-----BEGIN PGP SIGNATURE-----<br>Version: GnuPG
v1.4.1 (GNU/Linux)<br><br>iD8DBQFF2brEvKOJTPSBKa0RAr72AKC3NUDFCA2AbvCtZxLerx0KMekzagCfdTo6<br>eNUf9cXUllk9i5eatnCyGM0=<br>=9wg4<br>-----END PGP SIGNATURE-----<br><br>_______________________________________________<br>Full-Disclosure - We believe in it.
<br>Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/
</a><br></blockquote></div><br><br clear="all"><br>-- <br>Marcio Barbado, Jr.<br>==============<br>==============