TUCoPS :: Browsers :: nswind~1.txt

Netscape Communicator 3-4.5 allows a hostile page to look like a trusted site.

[ http://www.rootshell.com/ ]

Date: Tue, 16 Feb 1999 09:46:05 PST
From: Georgi Guninski <guninski@HOTMAIL.COM>
Subject: Netscape Communicator window spoofing bug

There is a bug in Netscape Communicator 3.04,4.06,4.5 Win95 and 4.08 WinNT,
which allows "window spoofing". After visiting a hostile page (or clicking a
hostile link) a window is opened and its location is a trusted site.
However, the content of the window is not that of the original site, but it
is supplied by the owner of the page. So, the user is misled he is browising
a trusted site, while he is browsing a hostile page and may provide
sensitive information, such as credit card number. The bug may be exploited
using HTML mail message. It needs Javascript enabled.

Workaround: Disable Javascript

Demonstration is available at:


This bug is different from the "frame spoofing vulnerability"

The code is:
function doit()

a.document.write("<H1>Look at the location bar!<BR>");
a.document.write("<A HREF='http://www.whitehats.com/guninski'>Go to
Georgi Guninski's home page</A></H1>");

function winopen() {


<A HREF="javascript:void(0)" onclick="winopen()"
onMouseOver="window.status='http://www.yahoo.com';return true">
Follow this link to go to www.yahoo.com (or somewhere else)
Note: My web page has moved. Look below for the new URLs.

Georgi Guninski

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH