Skip to main content

Tabnabbing

By
Tabnabbing is a computer exploit and phishing attack, which persuades
users to submittheir login details and passwords to popular websites
by impersonating those sites and convincing the user that the site is
genuine. The attack's name was coined in early 2010 by
Aza Raskin, a security researcher and design expert.

The attack takes advantage of user trust and inattention to detail in regard
to tabs, and the ability of modern web pages to rewrite tabs and their
contents a long time after the page is loaded. Tabnabbing operates in
reverse of most phishing attacks in that it doesn’t ask users to click
on a obfuscated link but instead loads a fake page in one of the open tabs
in your browser.

The exploit employs scripts to rewrite a page of average interest with
an impersonation of a well-known website, when left unattended for some
time. A user who returns after a while and sees the rewritten page may
be induced to believe the page is legitimate and enter their login, password
and other details that will be used for improper purposes. The attack can
be made more likely to succeed if the script checks for well known
Websites the user has loaded in the past or in other tabs, and loads a
simulation of the same sites. This attack can be done even if JavaScript is
disabled, using the "meta refresh" meta element, an HTML attribute used
for page redirection that causes a reload of a specified new page after a
given time interval.

The NoScript extension for Mozilla Firefox defends both from the JavaScript-
based and from the scriptless attack, based on meta refresh, by preventing
inactive tabs from changing the location of the page.

source
Labels:

Comments

Post a Comment

Popular posts from this blog

Place Files Inside EXE and Execute them using Gamemaker

By
I am fond of creating games in Gamemaker and Mugen. However I found an interesting way to create executable files that may contain anything inside them (may be a whole cracked Program) and may act as extractors or copy protectors Tools required  GameMaker 7 or above Procedure  1) Download and Install Gamemaker and start a Game Project by going to File -> New.  2) Every game consists of a Room in which all objects shall act and interact with each other.So Create a new room by either clicking on the icon on Standard toolbar or by going to Resources Menu -> Create Room.Name it anything you want.In my case ROOM0  3)Every Game consists of Objects which are responsible for all interactions. So create a new object by either clicking on the icon on Standard toolbar or by going to Resources Menu -> Create Object.Name it anything you want.In my case VIRUS  4)Now create a new script (Press CTRL+ALT+C or Resources Menu -> Create Script),Name it SCRIPT0...
Post a Comment
Read more

How to use Keyloggers – Detailed Tutorial and FAQs

By
Here is a DETAILED tutorial which contains every possible information that you need to know about keyloggers which includes how to use it, how it works etc. WARNING: I highly recommend that you read this post completely since every single piece of information is important. I know most of you are new to the concept of keyloggers. For some of you, this might be the first time you heard about the term “keylogger”. So to give you a clear picture and make you understand better I would like to take up this post in the form of FAQs (Frequently Asked Questions). Here we go… 1. What is a Keylogger? A keylogger (also called as spy software) is a small program that monitors each and every keystroke a user types on a specific computer’s keyboard. A keylogger program can be installed just in a few seconds and once installed you are only a step away from getting the victim’s password. 2. How Keylogger works? Once the keylogger is installed on a PC, it starts operating in the backgrou...
Post a Comment
Read more

Basic Introduction To SQL Injection

By
SQl injection is a vulnerability that allows an attacker to influence the queries that are passed to the back-end database.It has been present since the time databases have been attached to the web applications.However, the main credit of bringing SQL injection into public notice goes to Rain Forest Puppy who in 1998 wrote an article on it and in 2000 he wrote another article describing how he hacked one of the popular website on the internet using SQL injection. Before understanding the how SQL injection attacks we need to understand the Simple Three Tier Architectureor a Four Tier Architecture.This will clear your basics and give you a rough idea of how database-driven web applications work. Three Tier Architecture In a simple three tier datbase-driven architecture the three layers that are used are:- Presentation Tier(Browsers) Logic Tier Storage Tier(Database) The three tier architecture follows a linear relationship i.e Presentation Tier connects to the Logic Tier and...
Post a Comment
Read more