kayodeok's Weblog

Wednesday 17 December 2003

Bookmarklet For URL Spoofing Vulnerability

In order to clarify Microsoft's steps that you can take to help identify and to help protect yourself from deceptive (spoofed) Web sites, an MVP called Bill James has created a Bookmarklet for confirming whether a site is real or spoofed.

Bill James' bookmarklet sets up a link in the IE links bar that will make a box pop up and compare the real address to the visible address.

Here are the steps involved¹:

• Create a new Internet shortcut on the desktop, point it to any legitimate web address, and name it Check Address or something descriptive.
• Open Notepad and drag the new shortcut to it. You will see something like this:

  [InternetShortcut]
  URL=http://www.billsway.com/
  Modified=3099E08EBCC2C30179
  			

• Delete the address in the second line and substitute the JavaScript line, like this:

  [InternetShortcut]
  URL=javascript:alert("The real URL is: " + location.protocol + "//" +location.hostname + "/" + "\nThe address URL is: " + location.href + "\n" +"If the server names do not match, this may be a spoof.");
  Modified=3099E08EBCC2C30179
  			

• Save, then drag the shortcut from Desktop to the Links bar in IE (ignore the "may not be safe" warning).
• Now from any page you can click that link to check the address of the current web page you are viewing.

Related

• Steps to avoid getting tricked by spoof websites
• Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) Web sites
• Jesse's Bookmarklets

Related Entries

• Do Not Download This Patch
• MS Security Bulletins - 09 December

¹I fired up Internet Explorer to test this out and except for a few minor modifications which I will ignore, the bookmarklet works.

²This bookmarklet screws my layout; I will be changing it once I get the chance.