Re: [Full-disclosure] Using HTTP referer for phishing attacks

[xD 0x41 <secn3t@xxxxxxxxx>]

hrm now thats indeed of interest... good to point out...thx.


On 25 January 2012 21:09, Jerome Athias <jerome@xxxxxxxxxxx> wrote:
> This could be also used in some cases to Refer requests from "paypal" or
> such payment systems when there is no/bad validation checks on an
> e-commerce website.
>
> ie:
> if(Referer.Contains("paypal.com"))
> { ok }
>
> but what if i control "mypaypal.com"?
>
>
> Le 24/01/2012 20:14, Jan Wrobel a écrit :
>> Hi,
>>
>> Sorry if this is not new, but I didn't manage to find any mention of
>> such a technique.
>>
>> In short: HTTP referer field contains information where the web user
>> is coming from, which is often a trusted site such as a web search.
>> Having such information, a malicious web site can use several tricks
>> to fool the user into thinking that he or she returned to the
>> referring site. In fact, the user is taken to a generic phishing site
>> that intercepts all data exchanged between the user, the referring
>> site and sites visited from the referring site.
>>
>> More detailed write up with few examples is here:
>> http://mixedbit.org/referer.html
>>
>> Cheers,
>> Jan
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
> --
> Jerome Athias - NETpeas
> VP, Director of Software Engineer
> Palo Alto - Paris - Casablanca
> www.netpeas.com
> ---------------------------------------------
> Stay updated on Security: www.vulnerabilitydatabase.com
>
> "The computer security is an art form. It's the ultimate martial art."
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/