2

Hoping someone can look through the phishing HTML code I received and give me a second opinion whether or not I have been compromised. Also can anybody tell me what are telltale signs that suggests a payload exists in a site? Details (and code in pastebin link) below.

I received an e-mail from a someone I regularly e-mail with. They sent an e-mail regarding an progress communication with a hyperlink that has a data:text/html;base64 header in it.

It appears to be an obfuscated HTML page, which when decoded looks like an attempt at a google drive login page.

For some reason, Chrome auto-closed the tab whenever outlook redirected me into the page. I foolishly force opened it by going though my history. The site appears to be phishing for Google/Yahoo/etc account information and password. I did not enter any details into the site.

I only have rudimentary skills in HTML and JavaScript and as far as I can see it does not seem like arbitrary code has been executed on my browser and computer. But I'm hoping for someone to look through the decoded HTML and tell me if there are any problems before I take the nuclear option and reinstall the OS.

Note, I have spotted code that tries to identify my browser in the form of:

  // Opera 8.0+
            var isOpera = (!!window.opr && !!opr.addons) || !!window.opera || navigator.userAgent.indexOf(" OPR/") >= 0;
            // Firefox 1.0+
            var isFirefox = typeof InstallTrigger !== "undefined";
            // Safari 3.0+ "[object HTMLElementConstructor]" 
            var isSafari = Object.prototype.toString.call(window.HTMLElement).indexOf("Constructor") > 0 || (function (p) { return p.toString() === "[object SafariRemoteNotification]"; })(!window["safari"] || safari.pushNotification);
            // Chrome 1+
            var isChrome = !!window.chrome && !!window.chrome.webstore;
            // Blink engine detection
            var isBlink = (isChrome || isOpera) && !!window.CSS;

            //var output = "";
            if(isFirefox == true){
              var output = "Firefox";
            }else if(isChrome == true){
              var output = "Chrome";
            }else if(isSafari == true){
              var output = "Safari";
            }else if(isOpera == true){
              var output = "Opera";
            }else if(isBlink == true){
              var output = "Blink";
            }else{var output = "Unknown";}
            document.getElementById("browser").value = output;
  • 2
    If you didn't enter anything you're good. As far as I can see no malicious payloads, just a Google Drive phishing clone trying to send your credentials to http://212.129.5.116/mr/lock.php – J.A.K. Feb 19 '17 at 12:55
1

I see two possible scenarios of compromission through a web page:

  1. Phishing, like this appears to be the case at first sight. If you didn't enter anything in the page, then you're okay.
  2. Exploit. The webpage exploits a vulnerability (bug) in your web browser. If your browser is up to date and if you're not an especially high value target, this is unlikely.

So I think you're good.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.