Skip to Content.
Sympa Menu

internetworkers - IE Back Button -- Bad (link)

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: "Michael D. Thomas"<mdthomas AT mindspring.com>
  • To: internetworkers AT franklin.metalab.unc.edu
  • Subject: IE Back Button -- Bad (link)
  • Date: Wed, 17 Apr 2002 10:08:01 -0400



http://online.securityfocus.com/archive/1/267561

IE allows urls containing the javascript protocoll in the history list.Code
injected
in the url will operate in the same
zone/domain as the last url viewed. The
javascript url can be set to trigger when
a user presses the backbutton.

The normal behaviour when a page fails to
load is to press the backbutton. The error
page shown by IE is operating in the local computer zone
(res://C:\WINNT\System3\shdoclc.dll/dnserror.htm# on Win2000). Thus, we can
execute code and
read local files.






Archive powered by MHonArc 2.6.24.

Top of Page