There is a weird situation that I am stuck with regarding HTTP Basic Authentication.
Below is a hypothetical situation:
Lets say there is a certain domain, say https://myfacebook.com and there is a certain URL as : https://myfacebook.com/view_my_profile?imgURL=anyImageURL that myfacebook.com has designed so there users can share their profile pictures with each other without even logging into the site.
anyImageURL can be any URL assuming that myfacebook.com wants to give this flexibility to its users to load any image here from any location.
Now also to reiterate, lets assume that the URL can be accessed by anyone publicly without any authentication.
Now lets assume an attack scenario:
An attacker takes the URL https://myfacebook.com/view_my_profile?imgURL=anyImageURL from google cache (that he finds using some Google dorks for example) and replaces the anyImageURL with a server that he has hosted lets say http://attacker.com. And lets say that the attacker had configured http://atacker.com to serve 401 page (HTTP Basic Auth page)
And sends the following URL to the victim to make the victim make a final request as: https://myfacebook.com/view_my_profile?imgURL=http://attacker.com
Now when an UNSUSPECTING victim clicks on the URL https://myfacebook.com/view_my_profile?imgURL=http://attacker.com the victim gets presented with HTTP BA pop up and he may be lured into entering his myfacebook.com credentials.
Now my question is:
If at all the victim enters his credentials and submits them WHERE WILL THESE CREDENTIALS GO ? To myfacebook.com server because the page itself is being hosted on myfacebook.com or to attacker.com because the HTTP BA came from attacker.com ?