passbe/beef-migration-test-2 — Issue #108: Address bar hidding/replacment within the iFrame Redirect module
Author: passbe
Created: 2011-12-05 08:35:23+00:00
State: open

I thought we could take advantage from BeEF of the recently announced weaknesses regarding the URL bar on some mobile devices:

http://blogs.sans.org/appsecstreetfighter/2010/11/29/ui-spoofing-safari-iphone/
http://evil-lemur.com/mobile/

This could be implemented within the iFrame redirect and plain
redirect modules, as well as any other BeEF redirect capabilities,
both as an optional config setting within some modules, or through an
independent module (for mobile devices only).

A few extra improvements would include a different fake-bar images
when the mobile device is in a vertical or horizontal position, as
this is an easy way to identify the fake proof of concepts above (they
use a fix size for the fake-bar image).

Possible implementation (suggested by Wade):
--
It also seems like a simple augmentation of the iframe API function.

To support some other upcoming functionality I suggest we have an intermediate step. That is, an API function which allows for the explicit content of iframe specified. For example:
content = "<html><head>blah, blah, blah"
--

That sounds like the very flexible solution I would like to see,so
that different modules can make use of the API and add their own code
(e.g. address bar).We must consider the capability to specify the
whole iframe contents and a portion of the iframe content(e.g. top
header).

The "top header" can be two iframes or a single iframe whose first HTML object is the header. My suggestion is to be able to specify, through a
parameter within the module, what is he header to insert (typically an
image or HTML code containing an image plus other things) from a list
of prebuilt headers or from a file where you can create your own
header. Having a generic template for this header file would also
help.

Original link: http://code.google.com/p/beef/issues/detail?id=298