Other nomination

Navigation Hijacking (Frame/Tab Injection Attacks)

pdp

pdp on navigation hijacking: a page opens a window to a trusted site, polls it for login completion using script tags and error-code offsets, then rewrites w.location once the user has authenticated, dropping a lookalike "login failed" page under them. The address bar is never rechecked, so credentials are re-entered to the attacker.

Record

Researcher

pdp

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Tags

• phishing
• sop-bypass
• iframe
• dom
• side-channel
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of pdp, first published at the original source. Preserved copies are kept so the citation survives its host.