> ## Content Index
> Fetch the complete content index at: https://kudithipudi.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# IE Bug – Pretty Scary
- URL: https://kudithipudi.org/ie-bug-pretty-scary/
- Published: 2004-01-18T16:49:14.000Z
- Updated: 2004-01-18T16:49:14.000Z
- Description: During my daily visit to Richard Bejtlich’ blog, I came information about this flaw in IE which can be exploited to make people believe that they...
- Author: admin
- Tags: Networking, Technology, Uncategorized, Web, #wp, #wp-post, #Import 2026-08-23 02:32

During my daily visit to Richard Bejtlich’ [blog](http://taosecurity.blogspot.com/?ref=kudithipudi.org), I came information about this [flaw](http://www.securityfocus.com/archive/1/346948?ref=kudithipudi.org) in IE which can be exploited to make people believe that they are viewing/visting one site ([URL](http://en2.wikipedia.org/wiki/URL?ref=kudithipudi.org)) when in fact they are located on another website. To quote from the “[Zap The Dingbat](http://zapthedibgbat.com/?ref=kudithipudi.org)” (who actually discovered the bug)

---

**Vulnerability**  
There is a flaw in the way that Internet Explorer displays URLs in the address bar.  
By opening a specially crafted URL an attacker can open a page that appears to be from a different domain from the current location.**Exploit**  
By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a non printing character (%01) before the “@”.  
Internet Explorer doesn’t display the rest of the URL making the page appear to be at a different domain.

---

For example, if you click on thisTest Exploitbutton, you will see the URL http://www.microsoft.com in the address bar if you are using IE. But the full address of the URL is **http://www.microsoft.com%01@zapthedingbat.com/security/ex01/vun2.htm**.

Pretty scary eh.. Just imagine how much this can be abused. People can be tricked into entering their credit card information, usernames/passwords etc.. by mimicking valid sites. And as if though this is not bad enough, [Micro$oft](http://www.microsoft.com/?ref=kudithipudi.org) hasn’t even released a patch for this yet. So for now, either you type in all addresses manually in the address bar or use trusted saved bookmarks. I would recommend scrapping IE and to start using [Mozilla Firebird](http://www.mozilla.org/products/firebird/?ref=kudithipudi.org) as your default browser. It is fast, small, adheres to standards and is [FREE](http://www.mozilla.org/MPL/?ref=kudithipudi.org) \[as in beer\].