/* From: Michal Zalewski Date: Fri, 9 Dec 2011 11:04:22 -0800 Subject: the week of silly PoCs continues: data://www.mybank.com/ Just another short note... this is a somewhat compelling and entirely unnecessary phishing opportunity - and a tiny symptom of the mess with URL handling. Firefox and Opera allow you to omit MIME type in data: URLs, possibly put random garbage into that section, and still get a valid HTML document. This is a natural extension of how the Content-Type header is handled in HTTP, but probably makes little or no sense here. With the use of Unicode homographs, you can create fairly believable URLs especially in Firefox: http://lcamtuf.coredump.cx/switch/index2.html The appearance may vary depending on your font selection; see http://lcamtuf.coredump.cx/switch/reference.jpg for a sample capture. If you know the special role of "data:", this won't fool you. But most browser users don't, even if they grasp the basics of URL syntax to begin with (of course, that part itself is not true in all too many cases). PS. It is probably better known that a less convincing variant of this can be achieved with javascript: URLs in MSIE and some other browsers. /mz */ Exploit:

You sniff MIME / assume HTML on what?

Just a delicious and completely unnecessary vector for phishing. The most convincing version of this is for Firefox, thanks to Unicode homographs (YMMV, but here's a reference rendering); Opera comes second, and the MSIE variant (using a different approach) is barely of any interest.

Safari and Chrome avoid the problem by not doing MIME sniffing or presuming HTML on data: URLs (and by subsequently giving them a unique origin). The MSIE variant is prevented in said browsers by not showing javascript:"..." URLs in the address bar.

PS. If you combine this with my earlier PoC to seamlessly replace http://www.trustedsite.com with data://www.trustedsite.com, things get slightly more interesting.