How to create URL without A tag + A demonstration of the famed IE bug
By Angsuman Chakraborty, Gaea News NetworkSunday, February 1, 2004
Disclaimer: This article may erroneously trigger a malware alarm. This article and accompanying code is however simply a demonstration of a Javascript bug and doesn’t contain any malware.
I want to demonstrate two things. First a simple way to create hyperlink without using the standard A tag with HREF attribute. This works like a normal tag and looks the same. Yet it uses CSS & javascript event handlers to achieve the same effect using a span tag. This makes it potentially immune to crawling by robots.
As a side effect I use this code to demonstrate the IE bug where you click on the link of a site. The site shows up properly in the browser window, yet it actually loads a different site. As you will see from the demonstration that the status bar also displays properly the wrong site. Without further ado here’s the example:
Microsoft? nope, we are better 
The code is:
<span style="color='blue';text-decoration:underline" onmouseover="this.style.cursor='hand';window.status='http://www.microsoft.com/'" onmouseout="window.status=''" onclick="location.href=unescape('http://www.microsoft.com%01@www.taragana.com');">Microsoft? nope, we are better </span>
Look at the status bar and the Address bar of the displayed page to understand the effect. If you are using Netscape/Mozilla or other browsers based on the codebase you will not be able to view the spoof. In fact you will see the actual URL in the address bar.
However the hyperlink, status and the rest will work fine.
Disclaimer: This article may erroneously trigger a malware alarm. This article and accompanying code is however simply a demonstration of a Javascript bug and doesn’t contain any malware.
|
December 7, 2008: 12:09 pm
preciso com urgência montar um mini site ou uma página na internet gratis alguém saberia me informar como ou talvez até mesmo me ajudar? |
|
October 25, 2006: 1:27 pm
my name is daniel looper,im 20 5″11.im just a nice guy ready for a relationship.im an orphan,i was adopted when i was 4yrs by an african american missionary couples,they took me to africa.they discovered i was gay at the age of 18 and threw me out of the house,i live on my own now.i read engineering in school and im loking for a way to get out here and start a new life.i need some help from gays in america |
|
March 11, 2005: 5:14 pm
[...] page which open in multiple tabs Proper identification and warning for spoofed pages. See a demonstration of the famed IE bug with Firefox for an example. Watch out for Tabbed Interface In Fi [...] |
|
November 27, 2004: 5:33 pm
> Is this an IE bug? This means that if I am gona use it on my pages, tomorow won’t work? no ? Yep, that’s it. You never know when it will work and when it won’t |
|
November 27, 2004: 1:00 pm
Is this an IE bug? This means that if I am gona use it on my pages, tomorow won’t work? no ? |
 Lilia |
March 17, 2004: 5:09 am
what I got by following the link on IE 6.0 is an error page with the following url in the address bar http://www.microsoft.com@www.taragana.com/ and both times I tried the link I got a virus infection warning by a virus called Exploit-URLSpoof.gen here is the virus info: “Virus Characteristics – Update Feb 02, 2004 – http://www.microsoft.com/technet/treeview/?url=/technet/security/bulletin/MS04-004.asp Email spam is the most likely delivery method of such malicious hyperlinks, to lure users into updating account information. On January 10, 2004 a mass-spamming by someone phishing for Citibank account information. Other phishing attempts have targetted eBay, eGold, Paypal, online banking sites, and porno sites. Users should be leery of email messages asking users to click a hyperlink to update account information. It’s best to navigate to the site in question by typing the main web address into your web browser, and manually navigating to the account details page. There are no obvious symptoms of this exploit. Files detected as Exploit-URLSpoof are benign themselves. No system changes or damage occurs from accessing an Expliot-URLSpoof file. However, following an exploited hyperlink within a detected file can result in users being tricked to divulge personal information, install malicious software, etc.” |
|
February 2, 2004: 3:40 am
Doesn’t work for me (Safari 1.1, Mac OS X 10.3.2). Angsuman> Thanks for the info. Can you please tell me if it doesn’t behave as an URL (like it doesn’t show underline and/or doesn’t display http://www.microsoft.com in status bar and/or doesn’t go to http://www.taragana.com) or it doesn’t show http://www.microsoft.com in the address bar when clicked on the link and yet take you to http://www.taragana.com? The later I expect to be working with only IE (displaying http://www.microsoft.com in address bar while actually loading http://www.taragana.com) as it exploits an IE specific bug. The only reason I can think of the former not working is if CSS is not supported or javascript is not enabled. |
 Steve Citron-Pousty |
Emerson moura