Re: [FD] Safari Address Spoofing (How We Got It)

On Fri, May 29, 2015 at 1:47 AM, David Leo wrote: > Proof of concept: > http://www.deusen.co.uk/items/iwhere.9500182225526788/ > It works on fully patched versions of iOS and OS X. > How it works: > Just keep trying to load the web page of target domain. > > How We Got It: > Safari changes address

Re: [FD] Safari Address Spoofing (How We Got It)

> If you change "http://1.2.3.4/"; in your Safari code: > some URL in the real world(for example, dailymail.co.uk). > Your code won't work(page of target domain is simply loaded). Sure, but that's pretty obvious. /mz ___ Sent through the Full Disclosur

Re: [FD] Safari Address Spoofing (How We Got It)

Great blog, Michal! If you change "http://1.2.3.4/"; in your Safari code: some URL in the real world(for example, dailymail.co.uk). Your code won't work(page of target domain is simply loaded). The trick here is: "keep trying to load". Kind Regards, __ BestSec http://www.deusen.co.uk/i

Re: [FD] Safari Address Spoofing (How We Got It)

Well... http://lcamtuf.blogspot.com/2010/06/yeah-about-that-address-bar-thing.html On Thu, May 28, 2015 at 10:47 PM, David Leo wrote: > Proof of concept: > http://www.deusen.co.uk/items/iwhere.9500182225526788/ > It works on fully patched versions of iOS and OS X. > How it works: > Just keep try