IE - cross site click detection?

[ViPeR]

hi,

i stumbled upon a weird behaviour in IE, it
-indirectly- allows you to detect a mouse-click inside
another site - by placing an iframe between the
anchor-tags..



<a href="javascript:alert('ALERT : You clicked inside
iframe!')">
<iframe
src="http://gmail.google.com/gmail/help/privacy.html"
frameborder="0" scrolling="no"

marginwidth="0" marginheight="0" style="border: 0px;
width: 100%; height: 100%;">
</iframe>
</a>



rgds,
Gregory R. Panakkal
http://www.crapware.tk


__________________________________________________ ______________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony

[ViPeR]

hi,

yes, i had actually, mailed a "corrected" version of
my mail to bugtraq, stating that "clicks" are detected
only when you clicked on the blank areas of the page..
seems it was never delieverd.

your example seems to work fine.

rgds,
Gregory R. Panakkal
http://www.crapware.tk

--- James C Slora Jr <Jim.Slora@phra.com> wrote:
> For me, it only detects the click in certain
> portions of the iframe,
> depending on the construction of the page. This
> could be refined into some
> nasty stuff though.
>
> On pages built using Flash navigation, your
> construction does very
> interesting things
>
> An example that works OK:
>
> <a href="https://www.paypal.com/"><iframe
>
src="http://www.hypegallery.com/flash.php?retrieve=true"
> frameborder="0"
> scrolling="no" marginwidth="0" marginheight="0"
> style="border: 0px;
> width: 100%; height: 100%;">
>
> Mixed-content pages are especially interesting,
> since standard hyperlinks
> show their normal destination in the status bar,
> unhyperlinked images show
> nothing in the status bar.
>
> Start nesting frames and using image maps, etc, and
> you could have a totally
> unintelligible page that could do all sorts of nasty
> stuff while appearing
> totally legit.


__________________________________________________ ______________________
Yahoo! India Matrimony: Find your life partner online
Go to: http://yahoo.shaadi.com/india-matrimony