|Main Archive Page > Month Archives > full-disclosure-uk archives|
I talked about this before in a previous post. Mozilla pointed me on a flaw, and I went back to investigate it some more. I turns out that I'm right after all but in a different setting, but with the same idea. The below vector can be used to trick filters or surfers into performing various things. One of them is to steal cookies from surfers who think that the URI we give them is legit, or phish for credentials by setting up a cloned GMail page. This is due to the empty user name: http://:uri@phishdomain. Normally when you fill in the user name like: http://foo:uri@phishdomain. it will give a warning, which it should. But without a user name it won't give us a warning, and thereby tricking Firefox to strip the whole part before the at-sign and go to the domain after the at-sign. This can be dangerous in some ways, because of the unknown potential it holds. Triggering or bypassing RegEx filters who only look for a white-listed domain are some of the possibilities. Anyway, I thought it was worth mentioning it.
Here we can trick users into triggering a XSS on stumbleupon:
To obfuscate it, one can encode it or put a lot of spaces between: