It is very rare that I do Phishing campaigns (dang it I should ask to do more as they are interesting). I do have to answer customer questions, and talk about security awareness training often though.
I have heard people saying that “just hover your mouse over a suspicious link and it shows you where it is going!”. Generally this is a good feature of web browsers. However, it is definitely not to be relied on as shown in the video below:
With a tiny bit of JavaScript you can defeat that particular part of someone’s security awareness training. The source code is available below:
<a id="hey" href="http://totallylegit.com"
onmouseover="document.getElementById('hey').href='http://totallylegit.com'"
onclick="document.getElementById('hey').href='https://en.wikipedia.org/wiki/Dodgy'"
>Totally Legit</a>
Quite simple:
- When the mouse goes over the link the “onmouseover” event handler executes. This changes the URL to “http://www.totallylegit.com” so that is what the Web Browser shows to the user at the bottom.
- If the user actually clicks on the link the “onclick” event is triggered which replaces the URL with whatever we are actually wanting our victim to interact with.
Nothing new. Nothing earth shattering. I needed to document it as I have forgotten how to do this a few times but now it is written down forever. Hope it is useful.
cornerpirate.com 