Skip to content

Chrome address spoofing vulnerability proof-of-concept for HTTPS. (Original by David Leo.)

Notifications You must be signed in to change notification settings

musalbas/address-spoofing-poc

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

12 Commits
 
 
 
 
 
 
 
 

Repository files navigation

This is a modification of a proof-of-concept of a chrome address spoofing flaw published by David Leo (david.leo () deusen co uk) on the Full Disclosure mailing list.

(According to the original publication, this was reported to Google but it was regarded as a non-vulnerability.)

This version spoofs the HTTPS version of facebook.com. Surprisingly, it even shows the certificate in green:

You can try a live demo but note that you may have to try it a few times for it to work. There's a connection timing condition involved. However if you clone the repo locally, it should work 100% of the time.

Note that you can't interact with the spoofed web page, making the severity of this vulnerability limited as it can't be used to do direct phishing.

About

Chrome address spoofing vulnerability proof-of-concept for HTTPS. (Original by David Leo.)

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages