Below now carries out our flow, first, opens the registration the address “http://passport.sohu.com/web/signup.jsp?appid= 1000&ru= http://safe.it168.com/a.html”, the registration user “kxlzxtest”, the password is “testtest”, then submission.
The attention looked that the IE address fence, already arrived forge has registered the page, the input password registers. Registered normally, has entered in the mailbox.
Now examines kxlzx.txt, really has the password which steals! The entire forge process is this, let the user be swindled in unconscious.
Does for the ordinary surfer user, we do not readily believe anybody gives homepage link, even if is the friend (, because he also possibly is victim). But does for the programmer should pay attention, when you when project approach, do not let the user as far as possible participate in the control flow, specially sensitive place. The conceivable sohu this section of flow design original intention is for and other procedure coordination, after letting the user registration, direct skipping. But because does not have the inspection to originate, also has not inspected post for the registration procedure link whether is sohu own page, has caused the URL deceit formation finally. But this kind of crack is in flood in each big website, for example nine cities register the address “https: //passport.the9.com/login.php? redurl= http://safe.it168.com” and so on, if by the person use, will be created finally the very serious consequence.
Other pages: : <<Prev * 1 * 2 * 3
|
You are here: hacking technology
> crack analyzes
> Content
Category: Home
> crack analyzes