While the idea is fairly trivial, it seems pretty frightening to me - and neatly illustrates one of the points I'm making in
The Tangled Web. I highly doubt that even the most proficient and attentive users would be able to spot this happening in the wild.
(If you don't get it, try again, and follow instructions on the screen.)
Interesting results can be also achieved in some browsers with history.back(), but I'll leave this as an exercise for readers. The same goes for the implications it has for clickjacking, drag-and-drop, and other attacks normally associated with frames.
PS. Another silly proof-of-concept as a bonus: click here.
0 nhận xét:
Đăng nhận xét