URL & address bar spoofing, only possible on rogue access point

Question

Have been playing around with the whole DNS spoofing thing. How can a rogue/phishing URL be masked with a legitimate URL in the address bar (without using images)? I was under the impression that this was doable, but so far the only way to pull this off is with superimposed JavaScript images.

I managed to trick my own browser by modifying the hosts file on my Mac and pointing twitter.com to a localhost site. Is it therefore safe to assume that modifying a hosts file on a rogue access point would yield legitimate-looking pages that are actually rogue?

Answer 1

Actually, this can't be done with images. Images in browsers are confined to the main frame of the browser, and can't just escape that. Java Applets can, however, though these will ask for permission first.

In general the only way to mask a phishing URL by a legitimate one is to spoof DNS (or just go ahead and ARP spoof the whole connection and add a filter).

Is it therefore safe to assume that modifying a hosts file on a rogue access point would yield legitimate-looking pages that are actually rogue?

Well, APs usually don't have hosts files, but this is possible. In fact, if someone is on the same subnetwork as you, they can use ettercap with some filters (ARP spoofing) to mask phishing URLs.

---

In general, the only thing you can trust are SSL URLs (https://). These will display a green something on the address bar if the are legitimate, and will raise an error if they aren't (though this error can be caused by non-malicious situations too)

Answer 2

If the website has an XSS vulnerability, you can show your own code on that page and the URL remains. For example if there's an XSS vulnerability on Paypal, you could place a link bit.ly/abc in a spam mail resulting in an URL with paypal.com, but showing your phishing site instead.

That's why XSS vulnerabilities are so dangerous for you. And 90% of commercial sites have XSS vulnerabilities according to some study I just read a few days ago.

Regarding the images thing: There were some bugs in old browsers where you could place a floating image over the URL bar, but all these bugs have been patched. That's not possible in any current browser anymore. Of course you could still draw an URL bar within the page content and still trick some users.