How CSS position:absolute rule actually helps phishing?
Can someone help me out, I’m confused 🙁
How CSS position:absolute rule actually helps phishing? Can someone help me out, I’m confused
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
How CSS position:absolute rule actually helps phishing?
Can someone help me out, I’m confused 🙁
Look for a section called “Overriding Page Content” here.
It’s not so much that absolute positioning “helps” phishing, not any more than cars “help” drunk driving. But it is a tool that can be used for malicious purposes.
For example, say you’re running a website where users can login and post comments. Say also that you don’t properly sanitize your input and output and a user determines that he can post pure HTML content to his heart’s content. He decides to craft a post which includes an absolute-positioned div which mimics your login form identically and is positioned on top of it, obscuring your form. His new form posts the login credentials to his site instead of yours, and redirects the users back to your page.
The users, not suspecting anything has changed, enter their login credentials. They’re presented with the same page again. Maybe they try again, maybe they click on “forgot password,” maybe they give up, etc. Either way, he now has their login credentials. Did any of your users register on your site with the same credentials they use to login to their email? Their employer? Their bank?
Basically, the combination of an insecure website and some crafted absolutely-positioned content compromised the users.