Other nomination

Google Chrome HTTP AUTH Dialog Spoofing through Realm Manipulation

Aditya K Sood

Chrome through 5.0.375.127 does not scrutinise the realm value of a WWW-Authenticate header, so quotes placed inside it let an attacker control what the HTTP auth dialog displays and spoof which site is asking for credentials. Combined with Chrome not showing the real domain for obfuscated redirects, it supports credential phishing.

Record

Researcher

Aditya K Sood

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• ui-redress
• http
• header-injection
• filter-bypass
• owasp-a03-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Aditya K Sood, first published at the original source. Preserved copies are kept so the citation survives its host.