// archive
Tag: Phishing
Email Spoofing via IDN Homograph Domains
// TL;DR This isn’t the usual email-spoofing bug — it has nothing to do with SPF, DKIM, or DMARC. Instead of forging a target’s domain, I…
Email Spoofing: Why It Still Works, and How SPF/DMARC/DKIM Stop It
// TL;DR Email spoofing — sending mail that appears to come from someone else’s address — is old, simple, and still everywhere, because the core email…
Address Bar Spoofing in Microsoft Edge (CVE-2018-8383)
// TL;DR Microsoft Edge decided what to show in the address bar before the page it was navigating to had actually loaded. By redirecting to a…
Facebook Apps: Phishing Under a Trusted Domain
// TL;DR Facebook keeps raising the bar on account security, but one avenue stayed open for a long time: third-party apps hosted inside Facebook’s own canvas.…
Open Redirect in fb.me: Shortening Arbitrary External URLs
// TL;DR fb.me is Facebook’s URL shortener, and by design it’s only supposed to shorten Facebook URLs. Using the Facebook-to-Twitter cross-posting integration, I found it was…
Tabnabbing in Action: A Facebook Example
// TL;DR Tabnabbing (tabnapping) is a sneaky phishing technique that takes advantage of browser tabs you’ve left open and stopped paying attention to. Here’s a concrete,…
Content Injection in Instagram’s Password-Reset Page
// TL;DR I found a content injection (content spoofing) issue on Instagram’s password-reset confirmation page. A query parameter on the page was reflected directly into the…
What Is Tabnabbing?
// TL;DR Tabnabbing is a clever evolution of phishing that exploits something you do without thinking: leaving tabs open. A background tab quietly rewrites itself into…
What Is Phishing? How Phishing Attack Works
// TL;DR Phishing is a social-engineering attack that tricks people into handing over sensitive information — login credentials, card numbers, personal data — usually by impersonating…