Brave Software · Report #268984
Homograph Attack Bypass [ Tested on Linux & Windows ]
Validstatus
lowseverity
15upvotes
21 Sept 2017disclosed
Summary
If you want read guys : https://apapedulimu.click/homograph-attack-bypass-on-brave-browser/
How it was found
Summary:
at #175286 you has been patched, and i try it work, but i've another way to bypass it. when we add a site to our Homepage with @, it's not validate a url properly, make sure it's display the punycode.
Products affected:
Brave 0.18.36 ( Linux & Windows )
Steps To Reproduce:
- In browser add homepage with IDN
@ebаy.com/ - now close and open browser again
- you can see it's redirect to http://xn--eby-7cd.com/
{F221533}
References:
https://hackerone.com/reports/175286
Video
https://youtu.be/aCDeZRdRCuk (unlisted)