(If you don't get it, try again, and follow instructions on the screen.)
Interesting results can be also achieved in some browsers with history.back(), but I'll leave this as an exercise for readers. The same goes for the implications it has for clickjacking, drag-and-drop, and other attacks normally associated with frames.
PS. Another silly proof-of-concept as a bonus: click here.
It first shows http://banking.beaver-peak.us/banking_interface/ and then shows 'data:text/html;-peak.us/banking_interface/' ... So its very obvious it has happened, if you're looking at the URL bar. I also get a loading indicator on the tab.
ReplyDeleteBut of course, if you were actually looking at the site (as opposed to url and tab bar), you'd not notice, that is indeed scary.
The second one doesn't work at all, the fraction slash doesn't look like solidus, its angled significantly differently. But in other fonts...
This is in Iceweasel 8. I have the preference to show full URL turned on in about:config.