Other nomination

Using the HTML5 Fullscreen API for Phishing Attacks

Feross Aboukhadijeh · feross.org

A link whose status bar shows a bank's real URL instead calls preventDefault on click, enters HTML5 fullscreen, and paints screenshot-based OS and browser chrome matched to the visitor's platform, padlock included. Because fullscreen entry is barely signalled and change blindness hides the swap, the fake address bar is convincing. A working demo and browser-vendor responses are included.

Record

Researcher

Feross Aboukhadijeh

Published by

feross.org

In the archive

• Nominated for the 2012 Top 10 Web Hacking Techniques

Related sources

• Demonstration source

Tags

• ui-redress
• javascript
• dom
• https
• mitigation
• owasp-a02-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Feross Aboukhadijeh, first published at the original source. Preserved copies are kept so the citation survives its host.