Skip to content

Commit 74c9aee

Browse files
not-a-rootkitnot-a-rootkit
authored
Add Address Bar Spoofing Test Cases (#169)
* Add simpler test case for address bar spoofing. Rewrites current document without requiring navigation first. Also uses filtered ports, see: https://app.asana.com/0/1177771139624306/1205376531515103/f * Update formatting. * Add two more address bar spoofing tests and create directory for related test cases. * Add basic auth test cases for address bar spoofing. * Add test cases for about:blank rewrites, form action attack, base64 encoded document loads and unsupported schemes. * * Add links for visibility * Add title and run buttons where missing * Update download URL from Google to something we own * Delete spoof-js-page-rewrite.html
1 parent d011ebf commit 74c9aee

13 files changed

+281
-36
lines changed

‎index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ <h2>Browser Features</h2>
5353
<h2>Security</h2>
5454

5555
<ul>
56+
<li><a href="./security/address-bar-spoofing/">Address Bar Spoofing</a></li>
5657
<li><a href="./security/dos-reload.html">Infinite location.reload() loop</a></li>
57-
<li><a href="./security/spoof-js-page-rewrite.html">URL Spoofing - JS page rewrite</a></li>
5858
<li><a href="./security/csp-report/index.html">Leak of extension IDs via CSP</a></li>
5959
<li><a href="./security/js-leaks.html">Detect changes to JS objects in global scope</a></li>
6060
<li><a href="./security/badware/phishing.html">An example phishing page</a></li>

‎security/address-bar-spoofing/index.html‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="UTF-8">
5+
<title>Test Pages - Address Bar Spoofing</title>
6+
</head>
7+
<body>
8+
<h1>Address Bar Spoofing Pages</h1>
9+
<ul>
10+
<li><a href="/security/address-bar-spoofing/spoof-about-blank-rewrite.html">About:Blank Rewrite Spoof</a></li>
11+
<li><a href="/security/address-bar-spoofing/spoof-application-scheme.html">Unsupported Application Scheme Spoof</a></li>
12+
<li><a href="/security/address-bar-spoofing/spoof-basicauth-2028.html">Basic Auth Parameter Spoof (\u2028)</a></li>
13+
<li><a href="/security/address-bar-spoofing/spoof-basicauth-2029.html">Basic Auth Parameter Spoof (\u2029)</a></li>
14+
<li><a href="/security/address-bar-spoofing/spoof-basicauth-whitespace.html">Basic Auth Parameter Spoof (Whitespace)</a></li>
15+
<li><a href="/security/address-bar-spoofing/spoof-form-action.html">Form Action Spoof</a></li>
16+
<li><a href="/security/address-bar-spoofing/spoof-js-download-url.html">Download URL Spoof</a></li>
17+
<li><a href="/security/address-bar-spoofing/spoof-js-page-rewrite.html">Unsupported Application Scheme Spoof</a></li>
18+
<li><a href="/security/address-bar-spoofing/spoof-open-b64-html.html">Unsupported Application Scheme Spoof</a></li>
19+
<li><a href="/security/address-bar-spoofing/spoof-unsupported-scheme.html">Unsupported URL Scheme Spoof</a></li>
20+
</ul>
21+
</body>
22+
</html>

‎security/address-bar-spoofing/spoof-about-blank-rewrite.html‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>About:Blank Rewrite Spoof</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run() {
11+
let win = open("about:blank");
12+
win.document.write("<title>DuckDuckGo - Privacy, Simplified.</title>Not DDG.");
13+
setTimeout(() => {
14+
win.location = "https://duckduckgo.com/";
15+
win.window.stop();
16+
}, 500);
17+
}
18+
</script>
19+
</head>
20+
21+
<body>
22+
<p><a href="../index.html">[Home]</a></p>
23+
This test will try to confuse the browser to show the wrong domain in the URL bar by opening an about:blank page,
24+
rewriting the content, starting a navigation elsewhere and quickly stopping the
25+
navigation using window.stop().
26+
<button id="run" onclick="run()">Start</button>
27+
</body>
28+
29+
</html>

‎security/address-bar-spoofing/spoof-application-scheme.html‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>URL Spoofing - Unsupported Application Scheme</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run() {
11+
var t = window.open('filesystem:whatever', 'aa');
12+
t.document.body.innerHTML = '<title>DuckDuckGo - Privacy Simplified</title><h1>Not DDG.</h1>';
13+
}
14+
</script>
15+
</head>
16+
17+
<body>
18+
<p><a href="../index.html">[Home]</a></p>
19+
This test uses an unsupported application scheme and a href target to trick the browser into displaying the href
20+
target as the current address bar value, while actually navigating to an attacker controlled page.
21+
<a id="run" href="https://duckduckgo.com:" target="aa" onclick="setTimeout('run()',100)">
22+
<h1>Start</h1>
23+
</a>
24+
</body>
25+
26+
</html>

‎security/address-bar-spoofing/spoof-basicauth-2028.html‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>URL Spoofing - Basic Auth Whitespace (2028)</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run() {
11+
location = `https://www.google.com\[email protected]/`
12+
}
13+
</script>
14+
</head>
15+
16+
<body>
17+
<p><a href="../index.html">[Home]</a></p>
18+
This test uses a unicode whitespace character (\u2028) inside the username field of the basicauth portion
19+
of the URL to perform an address bar spoofing attack.
20+
<button id="run" onclick="run()">run</button>
21+
</body>
22+
23+
</html>

‎security/address-bar-spoofing/spoof-basicauth-2029.html‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>URL Spoofing - Basic Auth Whitespace (2029)</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run() {
11+
location = `https://www.google.com\[email protected]/`
12+
}
13+
</script>
14+
</head>
15+
16+
<body>
17+
<p><a href="../index.html">[Home]</a></p>
18+
This test uses a unicode whitespace character (\u2029) inside the username field of the basicauth portion
19+
of the URL to perform an address bar spoofing attack.
20+
<button id="run" onclick="run()">run</button>
21+
</body>
22+
23+
</html>

‎security/address-bar-spoofing/spoof-basicauth-whitespace.html‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>URL Spoofing - Basic Auth Whitespace Repeated</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run() {
11+
var whitespaces = "\u3000".repeat(300);
12+
location = `https://www.google.com${whitespaces}@example.com/`;
13+
}
14+
</script>
15+
</head>
16+
17+
<body>
18+
<p><a href="../index.html">[Home]</a></p>
19+
This test uses 300 repeated unicode whitespace characters inside the username field of the basicauth portion
20+
of the URL to perform an address bar spoofing attack.
21+
<button id="run" onclick="run()">run</button>
22+
</body>
23+
24+
</html>

‎security/address-bar-spoofing/spoof-form-action.html‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<meta http-equiv="Content-Security-Policy" content="form-action https://duck.co" />
8+
<title>URL Spoofing - Redirect Form Action</title>
9+
<script>
10+
// eslint-disable-next-line no-unused-vars
11+
function run() {
12+
document.forms[0].submit();
13+
}
14+
</script>
15+
</head>
16+
17+
<body>
18+
<p><a href="../index.html">[Home]</a></p>
19+
This test uses a form action on a redirect URL to trick the browser into displaying the
20+
redirect URL as the current address bar value, while trying to remain on the current page.
21+
<button id="run" onclick="run()">run</button>
22+
<form action="https://duck.co/">
23+
</form>
24+
</body>
25+
26+
</html>

‎security/address-bar-spoofing/spoof-js-download-url.html‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>URL Spoofing - Download URL</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run() {
11+
const w = open()
12+
w.opener = null
13+
w.document.write('<h1>Not Third Party Site.</h1>')
14+
w.location = 'https://bad.third-party.site/features/download/file/pdf'
15+
}
16+
</script>
17+
</head>
18+
19+
<body>
20+
<p><a href="../index.html">[Home]</a></p>
21+
This test uses a download URL for downloading a file to spoof the browser into displaying the download
22+
URL as the current origin while rewriting the document content to spoof the address bar.
23+
<button onclick="run()">Start</button>
24+
</body>
25+
26+
</html>

‎security/address-bar-spoofing/spoof-js-page-rewrite-simple.html‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta name="viewport" content="width=device-width">
7+
<title>URL Spoofing - Simple JS page rewrite</title>
8+
<script>
9+
// eslint-disable-next-line no-unused-vars
10+
function run () {
11+
document.write('Not DDG.<br>');
12+
document.location = 'https://duckduckgo.com:8443';
13+
}
14+
</script>
15+
</head>
16+
17+
<body>
18+
<p><a href="../index.html">[Home]</a></p>
19+
20+
This test will try to confuse the browser to show the wrong domain in the URL bar by rewriting the current page
21+
content and loading a URL that will timeout.
22+
23+
<button onclick="run()">Start</button>
24+
</body>
25+
26+
</html>

0 commit comments

Comments
 (0)