4 ms·

If you’re hosting a static website on cat-jokes... then any requests made are going to the owners of example.co.uk not to whoever has cat-jokes... It only work

• tialaramex 6y ago
  The on path attacker isn't hosting the website (static or otherwise) on http://cat-jokes.example.co.uk/ http://cat-jokes.example.co.uk/ indeed with more work the name needn't even "exist" let alone a site. Let's suppose I'm an on path adversary, you're my victim and example.co.uk are a passive third party. You have credentials for https://example.co.uk/ https://example.co.uk/ stored in Bitwarden with default settings I inject any URL into any flow that will cause your browser to try to fetch something from http://cat-jokes.example.co.uk/ http://cat-jokes.example.co.uk/ maybe it's an image URL, or a frame. But that's an HTTP site, so I can intervene when your browser connects and impersonate as cat-jokes.example.co.uk to ask for Basic auth credentials, Bitwarden cheerfully fills them out automatically with your credentials for the secure site https://example.co.uk/ https://example.co.uk/ and sends them plaintext so now I get your credentials. Nothing looks out of place to you, maybe an image or frame was slow to load, but certainly no alerts, no indication anything weird happened.