4 ms·
Examples from what I've seen: https://account:paypal.com.login@verified-account.com/phish This, to the untrained eye, might at first glance look like a pa
by zaarn 7y ago
Examples from what I've seen:
https://account:paypal.com.login@verified-account.com/phish
This, to the untrained eye, might at first glance look like a paypal.com link. In fact, it belongs to verified-account.com and it abuses the capability of URLs to contain a username and password to make it look legit.
- zepolen 7y agoDon't even need that account: at start, this works in chrome: https://www.paypal.com@google.com https://www.paypal.com@google.com
- b3n 7y agoIn Firefox it tells me: You are about to log in to the site “google.com” with the username “www%2Epaypal%2Ecom”, but the website does not require authentication. This may be an attempt to trick you. Is “google.com” the site you want to visit?
- deftnerd 7y agoGold star for Firefox! That's an excellent feature.
- jefftk 7y agoFrom the error message it sounds like if this was an attacker controlled site configured to require authentication it wouldn't trigger? If so it's not that useful a defense since whether to require auth is entirely under the attacker's control.
- jeroenhd 7y agoWow, I knew Firefox warns for these by default so I thought nobody would ever use this for a phishing attack anymore but it looks like Chrome just meekly follows the standard. That's too bad, really, this is a very easy way to create very realistic phishing mails.