ID and I were playing around with some weird redirection
obfuscation and came across these a few days ago (works in latest
version of Firefox and Netscape on untrusted site settings). Sorry that
this is a little ho-hum but it's probably worth documenting:
http://www.visa.com@rsnake and
http://rsnake:www.visa.com This seems like something that could confuse users. This is the
same old "feeling lucky" stuff built into browsers. Not so much a hack
as just confusing behavior to users which could lead to unintended
redirection and potentially more sucessful phishing attacks. This
relies on being the #1 page rank in something, but that is pretty easy
with obscure search terms.
-RSnake
http://ha.ckers.org/xss.html-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl--------------------------------------------------------------------------
