Skip to main content

URLs Anchor Text Spoofing

Hello friends,

 In this post I would talk about how to spoof URLs visually using Unicode character Right to Left Override (U+202E).

 So let's start with "What is U+202E" ?

 In very simple words it's a Unicode Character that VISUALLY changes all subsequent characters from right position to the left position.

 Example :

 In unicode aware environment "\u202Eabcdef" would be displayed as "fedcba" but the actual string would still be "\u202Eabcdef".

 Demo in Browser Console :


This trick is very old and it was being used to spoof the extension of files.
However now the same method can be applied to spoof the anchor text of the URLs as well.

 In many websites like Facebook, Gmail, Instagram, WhatsApp, etc this character (U+202E) is removed from the anchor link but kept in anchor text hence we can easily spoof the anchor text there.

 Let's spoof the anchor text of URL "rakeshmane.com" to "facebook.com"

Now simply copy pasting it to a Facebook post :

As you can see the character (U+202E) is not present in the anchor link but it is present in the anchor text hence anchor text got spoofed to "www.facebook.com/security#/moc.enamhsekar" but clicking on the link would redirect you to "rakeshmane.com/#ytiruces/moc.koobecaf.www"

 Evil stuffs you can do with this trick :


Same flaw on Gmail:

Again you can see the unicode (U+202E) character in action.

 The actual problem arises when you send a download link of a file.
Using this trick an attacker can spoof the anchor text of URLs to a legitimate website so by thinking it's a legit website URL any user will simply click on the link and the malicious file from attackers website will be directly downloaded to victim machine and victim won't even notice.



Last time when I checked,  this trick worked on Instagram and WhatsApp as well.
However it's a Won't Fix issue. So sharing it to spread awareness.

 Conclusion: 

 Do not trust anchor text of URLs.
References :
http://www.fileformat.info/info/unicode/char/202e/index.htm
https://www.explainxkcd.com/wiki/index.php/1137:_RTL

Comments

Post a Comment

Popular posts from this blog

JSP ContextPath Link Manipulation - XSS

This post is about how to manipulate resource links of HTML elements (script, img, link, etc) when getContextPath  method is used to obtain base path of resources. With the ability to manipulate links you can do XSS, CSS Injection, etc. Basically we are going to use path parameters to manipulate context path such that links would point to attacker's domain. There's a good blog that talk about the similar issues :  https://superevr.com/blog/2011/three-semicolon-vulnerabilities However this post is more about manipulating context path to hijack resource links of HTML elements .  So let's have a look at a simple JSP page ( test.jsp ) Ref :  https://www.roseindia.net/jsp/request-getcontextpath.shtml This page just loads some resources like script, image, css and that's it. It doesn't take any direct input from user but it is using value returned by r equest.getContextPath() as base path to resources link. What can we do here? Let's try to contro
1 comment
Read more

U-XSS in OperaMini for iOS Browser (0-Day) [CVE-2019-13607]

TL;DR :  The latest version (16.0.14) of  Operamini for iOS browser is affected by an Universal-XSS vulnerability which can be triggered by performing navigation from target domain to attacker controlled domain. When attacker controlled domain returns " javascript:code_here " in " location " header then browser executes the javascript code in the context of target domain instead of attacker domain. This vulnerability is yet not fixed by Opera team.  Update [15 July 2019] :  CVE-2019-13607 is assigned to this vulnerability. So while playing with Operamini browser I noticed that when a navigation to " javascript " protocol occurs via " location " header then browser executes the provided javascript code. For example if the value of " location " header is " javascript:alert() " then javascript code "alert()" gets executed by the browser. Normally browsers prevent navigation to " javascript: " URL
Post a Comment
Read more

Xssing Web Part - 2

Xssing Web With Unicodes Hello friends,  This is the second part of "Xssing Web". In this post I would show how to abuse unicodes to bypass XSS filters.  BTW if you want to check previous part click here . Note : If you think there are any mistakes in this post then kindly mention it in comments. I have developed several XSS challenges to show how unicodes can be used to bypass filters. If you want to try those challenges first then click here , get back here if you couldn't solve any. Abusing Unicode : So what is Unicode? -> Unicode is nothing but the encoding standard. It  defines  UTF-8 ,  UTF-16 , UTF-32 , etc encodings. 1) UTF-8 : Characters Size : 1 byte to 4 byte Example : Character "A" => 0x41 Character "¡"  => 0xC2 0xA1 Character "ಓ" => 0xE0 0xB2 0x93 Character "𪨶" => 0xF0 0xAA 0xA8 0xB6 2) UTF-16 : Character Size : 2 byte However in UTF-16 there are two
5 comments
Read more