Everyone says not to click on "malicious URLs". Are there any attacks where the URL itself, rather than the resource accessed by the URL, is the attack vector?
3
-
Yep! (The same thing happened more recently with the custom protocol handler dialog in Safari on Mac OS X, but I haven’t been able to find it.) – Ry- Oct 31 '14 at 19:44
6
Actually this is very timely as there's a relatively new attack where the data passed in the URL is the attack vector.
Reflected File Download abuses non-malicious servers by passing them malicious data and then having it reflected back to users, so it appears to the user to have come from a "trusted" source.
answered Oct 31 '14 at 7:32
-
just read the paper; first impression: "will this ever end?" – that guy from over there Oct 31 '14 at 8:08
-
1Is RFD attacks still reproducible on OSX Chome? I just tried and can't get it to work. – MD6380 Dec 7 '16 at 2:29
