0

Is it possible for someone to make a purposefully vulnerable site then lure users to his site where he then takes advantage of that vulnerability to hack their social media accounts etc? If so how?

9
  • 1
  • Here's a takeaway: "..Is it possible for someone to make a purposefully vulnerable site then take advantage of that vulnerability to hack the users?.." Yes. Oct 28, 2020 at 21:54
  • @CriticalSYS How tho? Oct 28, 2020 at 21:57
  • 1
    Fundamentally that's what a Honeypot is, but the users are generally malicious actors. Oct 28, 2020 at 22:04
  • 2
    I don't think the site would be vulnerable, but rather malicious in nature. Oct 28, 2020 at 23:18

1 Answer 1

2

Is it possible for someone to make a purposefully vulnerable site

Yes.

then take advantage of that vulnerability to hack the users?

Yes but, he doesn't need the vulnerability.

When we talk about a vulnerable site, that usually means it allows anyone to do some action which was not intended by the owner. For example, a vulnerable StackOverflow site could allow anyone to log in under the account of someone else. However, if I was the owner of StackOverflow and wanted to take over your account I wouldn't need to exploit a vulnerability on the page. I could do that directly (such as manually changing your password to something else).

The main reason I can think for that would be for plausible deniability / looking inept rather than malicious.

4
  • What about if there was no user interaction any farther than simply opening the website ? Oct 29, 2020 at 13:12
  • @mohamedelgamal and the website would be vulnerable in what sense? I'm not understanding your question.
    – Ángel
    Oct 29, 2020 at 21:40
  • like it would be vulnerable to some sort of web app vuln that would allow it to hack its users social media/work/personal accounts on the users laptop. For example something that would allow it to steal cookies. That is just an example tho. Oct 30, 2020 at 19:24
  • The app doesn't need to be vulnerable. It can already see its own cookies. You might be thinking on stealing cookies of a different website, but it's not the that would need to be vulnerable, but the user browser which is not supposed to give your Gmail cookies to StackOverflow.
    – Ángel
    Oct 30, 2020 at 22:03

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .