Visiting quite a few malwaretisers (I think this is the term :) ), I get popups with address bar something like data:text/html;base64,PGh0bWw+PGJvZHk+PHNjcmlwdD52YXIgZT0obmV3IERhdGUpLmdldFRpbWUoKTt2YXIgZWZ3PXdpbmRvdy5uYW1lLnNwbGl0KCdfJylbM107aWYoZS1lZnc8MjUwKXt3aW5kb3cubG9jYXRpb249Jyc7fTwvc2NyaXB0PjwvYm9keT48L2h0bWw+

The encoded part of this one translates to: <html><body><script>var e=(new Date).getTime();var efw=window.name.split('_')[3];if(e-efw<250){window.location='';}</script></body></html>

What I do not know is why browsers support such inlining of pages/scripts, and where the actual malicious URL enters the picture. Perhaps it has already been queued and when it opens it has nothing to do with this snippet?

  • it's a useful capability for web devs, though the <iframe>'s new content attrib encroaches. It's useful to be able to control a whole dynamic page that's not in-domain. note that window.name is tied to the tab: pages on different domains can read window.name values set by other sites/protocols. – dandavis Mar 28 '17 at 18:31

I think data uris like the one you mentioned have the benefit of increased website performance/ load time because it eliminates the network connection latency of downloading another page or frame.

In many legit cases there is no additional url. It's literally a page embedded within a page.

What I've seen with credential phishing though is attackers use data uris like this and then the "url" comes into play as the post action in the html form. So the password is collected in a text box in the data uri but posted to the attackers url.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.