3

Visiting quite a few malwaretisers (I think this is the term :) ), I get popups with address bar something like data:text/html;base64,PGh0bWw+PGJvZHk+PHNjcmlwdD52YXIgZT0obmV3IERhdGUpLmdldFRpbWUoKTt2YXIgZWZ3PXdpbmRvdy5uYW1lLnNwbGl0KCdfJylbM107aWYoZS1lZnc8MjUwKXt3aW5kb3cubG9jYXRpb249Jyc7fTwvc2NyaXB0PjwvYm9keT48L2h0bWw+

The encoded part of this one translates to: <html><body><script>var e=(new Date).getTime();var efw=window.name.split('_')[3];if(e-efw<250){window.location='';}</script></body></html>

What I do not know is why browsers support such inlining of pages/scripts, and where the actual malicious URL enters the picture. Perhaps it has already been queued and when it opens it has nothing to do with this snippet?

1
  • it's a useful capability for web devs, though the <iframe>'s new content attrib encroaches. It's useful to be able to control a whole dynamic page that's not in-domain. note that window.name is tied to the tab: pages on different domains can read window.name values set by other sites/protocols.
    – dandavis
    Mar 28, 2017 at 18:31

1 Answer 1

2

I think data uris like the one you mentioned have the benefit of increased website performance/ load time because it eliminates the network connection latency of downloading another page or frame.

In many legit cases there is no additional url. It's literally a page embedded within a page.

What I've seen with credential phishing though is attackers use data uris like this and then the "url" comes into play as the post action in the html form. So the password is collected in a text box in the data uri but posted to the attackers url.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .