paraw wrote: >> The first example uses setInterval() call with relatively small interval >> value (e.g. 0) to change window.location property. A browser is >> entrapped within the attacking web site while the user thinks that >> browser actually left the page. >> http://alt.swiecki.net/konq2.html >> [...] > > Didn't really work on my computer. The content of the address bar could be seen changing > continuously between swiecki.net and google.com, probably in a way similar to what happens with Safari. I tested this one with Konqueror 3.5.5 (on Debian Etch) and it worked for me. Can anyone confirm or deny this? >> Tested with Konqueror 3.5.7 on Linux 2.6 > > Again, it didn't work. My address bar showed "%20@xxxxxxxxxxxxxxx/saft2.html", aligned to the right. I suppose this behaviour is related to this patch http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064654.html It seems to me that only patched konquerors are vulnerable :) -- Robert Swiecki
