Address bar spoofing is a major security issue in past it was discovered by Rafay Baloch a security researcher.

Reference to address bar spoofing : http://www.rafayhackingarticles.net/2016/08/google-chrome-firefox-address-bar.html

Right now i have also discovered a vulnerability similar to address bar spoofing where an attacker can send a fabricated link to a victim and if he ( victim ) opens that link in his Android Chrome Browser his url on the address bar will be spoofed.

This type of address bar spoofing affects mobile chrome browsers like android chrome. Where is we as an attacker create a sub-domain like e.g " accountsloginsgn.google.com.pk.madadgaaar.com " and if we open this in android chrome browser Address bar will show us " accountsloginsgn.google.com.pk " as an address while the real sub-domain such as madadgaaar.com would be ignored to the right side while displaying the sub-domain on address bar.


Attack scenarios :-

1- This has been tested on different android mobiles using the latest google chrome browser. Mobile phones like " Infinix Hot 4 " , " Q mobile s4 " , and " Q mobile LT700 " were used and android chrome browser was showing a spoofed url which was actually a sub-domain of a third party website madadgaaar.com 


2- By slightly modifying the url as per mobile condition attacker can code such type of javascript which first gains mobile model information and after redirect user to a url which is justified for that mobile to get it spoofed.

i have also attached some screen shots which shows how it could be used for address bar spoofing. I hope its clear everything its very simple but a critical issue as was discovered in past which needs a must fix / patch on android chrome.

 

Deleted: 15355875_1806019832971268_1393308180_n.png 35.3 KB

	15355875_1806019832971268_1393308180_n.png 35.3 KB View Download

Deleted: 15423695_1806019636304621_1792064142_n.png 78.6 KB

	15423695_1806019636304621_1792064142_n.png 78.6 KB View Download

Deleted: 15423758_1806019846304600_84439745_n.png 44.2 KB

	15423758_1806019846304600_84439745_n.png 44.2 KB View Download