Danny wrote: > > On Wed, 9 Feb 2005 12:24:29 -0800, Thor Larholm wrote:
> > The addressbar can by design be programmatically changed to display > > anything you want at any time, including when you hover over a link > > and the onmouseover event fires. Simply change the window.status > > property from JS. > > Based on my answer above, I take this as a definite "yes" by the > means of the web designer/developer simply changing the window.status > property in their java script? <a href="http://bad-site.xx/"; onmouseover="javascript:window.status='http://nice-site.xx';">blah</a> If you point your mouse over that link, you'll see "http://nice-site.xx"; in the status bar, but clicking will lead you to http://bad-site.xx/. This is already widely used in spoof e-mails. [.xx is a ccTLD which, per RFC and ISO standard, will *never* be used, so my example domains will never exist. Just a precaution.] Best regards, Martin Stricker -- Homepage: http://www.martin-stricker.de/ Linux Migration Project: http://www.linux-migration.org/ Red Hat Linux 9 for low memory: http://www.rule-project.org/ Registered Linux user #210635: http://counter.li.org/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
