Awesome.

It says no virus found so either you''re really paranoid or your virus scanner sucks.

i got an email from paypal once telling me to login and change some settings, and it gave a link that looked like it linked to paypal (even in the status bar), and when you followed the link, the address bar said it was paypal. However, the page looked slightly off, so I started to investigate. Examining the html of the link in the email, it was NOT paypal. It was a ruse to get people to login with their paypal id''s and passwords. Getting the link to change text was pretty easy, but I would like to know how they got the address bar to look like it was paypal.

<a href=''somebadplace'' onmouseover=''javascriptarent.status="http://www.paypal.com"; return;'' onmouseout=''javascriptarent.status=""; return;''>http://www.paypal.com</a>

something like that, you get the idea.

---

capn_midnight | Captain Midnight | deviantArt
ACM | SIGGRAPH | Generation5

*shrugs*

www.paypal.com@www.google.com, or something. Old IE trick.

quote:

---

Original post by TiffanyCat
*shrugs*

www.paypal.com@www.google.com, or something. Old IE trick.

---

Yes, this is how it was done. This works in Mozilla (latest version) if you copy and paste that URL, but I believe clicking such a hyperlink in Mozilla replaces the address bar with www.google.com. Let's see.

EDIT: I seem to be wrong... Firefox displays the fake address, but IE 6.0 displays the real address (www.google.com). Hm.

~CGameProgrammer( );

_{-- Upload up to four 1600x1200 screenshots of your projects, registration optional. View all existing ones in the archives.}.

[edited by - CGameProgrammer on March 26, 2004 6:35:35 PM]

quote:

---

Original post by CGameProgrammer
EDIT: I seem to be wrong... Firefox displays the fake address, but IE 6.0 displays the real address (www.google.com). Hm.

---

Firefox took me to Google.

it says Invalid Syntax Error in IE6.

My IE shows the fake address and goes to page cannot be found.

quote:

---

Original post by alnite
it says Invalid Syntax Error in IE6.

---

%DEITY% forbid it should be a Valid Syntax Error.

CHENEY!!

[edited by - Promit on March 26, 2004 10:06:45 PM]

quote:

---

Original post by alnite
it says Invalid Syntax Error in IE6.

---

Yep, microsoft just disabled this syntax in IE6 about a month ago(?). (There is a registery patch to change this, but to me personally its more of an annoyance than something good)

quote:

---

Original post by Oluseyi

quote:

---

Original post by CGameProgrammer
EDIT: I seem to be wrong... Firefox displays the fake address, but IE 6.0 displays the real address (www.google.com). Hm.

---

Firefox took me to Google.

---

Yes, it takes you to Google, but the address bar displays the fake address "http://www.paypal.com@www.google.com" instead of the actual address it went to, which is "http://www.google.com".

~CGameProgrammer( );

_{-- Upload up to four 1600x1200 screenshots of your projects, registration optional. View all existing ones in the archives.}.

quote:

---

Original post by CGameProgrammer
Yes, it takes you to Google, but the address bar displays the fake address "http://www.paypal.com@www.google.com" instead of the actual address it went to, which is "http://www.google.com".

---

Yep, and that is perfectly correct behaviour. This is no fake address or bug, it''s valid URL syntax:

protocol://[user[assword]@]subdomain.domain.tld/
 

Unfortunately the syntax has been exploited by some people to fool dumb users, or non-conforming browsers.

It should be an option in a browser, whether the user wants to display a full URL in the address bar (including optional login information, which can be a security risk), or not. A browser should also warn you, when you click a link containing login information, as this URL syntax is not very common for legitimate purposes.

Someone should write a plugin for Mozilla handling that (if it hasn''t already been done ?)

I think there was some bug somewhere where the address was like:

www.fakeaddress.com[nullcharacter]@www.realaddress.com

When the browser printed the address, it would stop at the null character, thinking it was a null terminated string.

quote:

---

Original post by smart_idiot
I think there was some bug somewhere where the address was like:

www.fakeaddress.com[nullcharacter]@www.realaddress.com

When the browser printed the address, it would stop at the null character, thinking it was a null terminated string.

---

Oh, that's what I'm thinking of. Let's test it.

http://www.gamedev.net%00@www.google.com

EDIT: Of course this isn't a real null character. But interestingly, in IE 6.0, "www.gamedev.net" displays in the status bar, even though it takes you to Google. But the address bar displays the entire URL, not gamedev.net.

~CGameProgrammer( );

_{-- Upload up to four 1600x1200 screenshots of your projects, registration optional. View all existing ones in the archives.}.

[edited by - CGameProgrammer on March 27, 2004 7:49:55 AM]

Yup, it only displays gamedev.net when hovering o_O (IE6, of course )

[edited by - mattd on March 27, 2004 7:46:34 AM]