Show HN: Web pages stored entirely in the URL

Re:Show HN: Web pages stored entirely in the URL by prsecurity on Monday July 01, 2019 @11:37PM (#20331935)

You still need something to serve you the initial document.write js, unless you are going to convince people to open your links with locally saved "index.html". I called it "XSS" because you can execute arbitrary javascript, and I was trying to avoid bluntly calling it "malware".

Though I probably should have. Here is an example of a HackerNews login page served with jstrieb.github.com https://tinyurl.com/yypvh3by, you can login to news.ycombinator.com with it, but it easily could have been a phishing site.

My point is, this is a very good idea for offensive operations.

[ Parent | on HN ]

Re:Show HN: Web pages stored entirely in the URL by Thorrez on Tuesday July 02, 2019 @11:46PM (#20341439)

But someone could register the github account newsycombinator and then serve an identical phishing page at newsycombinator.github.io .

I guess you're right that it's useful for takedown resistance in phishing attacks. It's useless for small, sophisticated, targeted phishing attacks, but for large blunt untargeted phishing attacks it could be useful to have a site that would be difficult to take down and censor.

But I do consider phishing different than XSS.

[ Parent | on HN ]