IE Address Bar Spoofing

Find your website's Achilles' Heel


I recently found on securityfocus mailinglist a bug in IE which can be exploited with a simple javascript code to spoof the address bar location…

This allow attacker inject a malicious shockwave-flash application into Internet Explorer while it is display another URL (even trusted sites).

The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 + Microsoft Windows XP SP2 and previous versions.
Sample code:


Perform the test

If you are vulnerable you will see the flash intro of buctuong.com while the address bar is http://www.microsoft.com/ If you have a very fast connection you may change my flash application to a larger one to make loading time take longer.

This spoofing technique discovered and proved by

Hai Nam Luke
K46A – NEU, Hanoi


Posted in: Exploits/Vulnerabilities

, , , , , ,

Recent in Exploits/Vulnerabilities:
- ERTS – Exploit Reliability Testing System
- shadow – Firefox Heap Exploitation Tool (jemalloc)
- Intel Hidden Management Engine – x86 Security Risk?

Related Posts:

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 235,056 views
- AJAX: Is your application secure enough? - 120,162 views
- eEye Launches 0-Day Exploit Tracker - 85,582 views

Malwarebytes Anti-Exploit Premium | 1 Year 1 PC for $24.95


One Response to IE Address Bar Spoofing

  1. Hungry Hacker July 11, 2008 at 7:09 am #

    Hello darknet,
    This is Hungry Hacker from the site mentioned above. I liked your website and I would like to perform link exchange with your website. If you are interested then reply me.
    Regards,
    Hungry Hacker.