Re: Mouseover URL spoof with IE

[Martin Stricker <shugal () gmx de>]

Danny wrote:
> On Wed, 9 Feb 2005 12:24:29 -0800, Thor Larholm wrote:

> > The addressbar can by design be programmatically changed to display
> > anything you want at any time, including when you hover over a link
> > and the onmouseover event fires. Simply change the window.status
> > property from JS.
>
> Based on my answer above, I take this as a definite "yes" by the
> means of the web designer/developer simply changing the window.status
> property in their java script?

<a href="http://bad-site.xx/";
onmouseover="javascript:window.status='http://nice-site.xx';";>blah</a>
If you point your mouse over that link, you'll see "http://nice-site.xx";
in the status bar, but clicking will lead you to http://bad-site.xx/.
This is already widely used in spoof e-mails.

[.xx is a ccTLD which, per RFC and ISO standard, will *never* be used,
so my example domains will never exist. Just a precaution.]

Best regards,
Martin Stricker
-- 
Homepage: http://www.martin-stricker.de/
Linux Migration Project: http://www.linux-migration.org/
Red Hat Linux 9 for low memory: http://www.rule-project.org/
Registered Linux user #210635: http://counter.li.org/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html