Skip to content

Commit 0068165

Browse files
not-a-rootkitnot-a-rootkit
authored
Add extra phishing detection test pages (#217)
* Add extra phishing detection test pages * Add meta refresh and URL tampering test cases. * Add URL capitalization tampering case * Add form submission, iframe top navigator and service worker test cases.
1 parent af4c09f commit 0068165

18 files changed

+470
-2
lines changed

‎index.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,8 @@ <h2>Security</h2>
6161
<li><a href="./security/dos-reload.html">Infinite location.reload() loop</a></li>
6262
<li><a href="./security/csp-report/index.html">Leak of extension IDs via CSP</a></li>
6363
<li><a href="./security/js-leaks.html">Detect changes to JS objects in global scope</a></li>
64-
<li><a href="./security/badware/phishing.html">An example phishing page</a></li>
6564
<li><a href="./security/popups/popup-launcher.html">Popup noopener/noreferrer tests</a></li>
65+
<li><a href="./security/badware/">Phishing Detection Pages</a></li>
6666
</ul>
6767

6868
<h2>Privacy Protections Tests</h2>

‎security/badware/index.html

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="UTF-8">
6+
<title>Test Pages - Phishing Detection</title>
7+
</head>
8+
9+
<body>
10+
<h1>Phishing Detection Test Pages</h1>
11+
<a href="/">[Home]</a>
12+
<ul>
13+
<li><a href="./phishing.html">Standard Phishing Test</a></li>
14+
<li><a href="./phishing-iframe-loader.html">Phishing iFrame Loader</a></li>
15+
<li><a href="./phishing-js-redirector-helper.html">Phishing JS Redirector (Direct)</a></li>
16+
<li><a href="./phishing-js-redirector.html">Phishing JS Redirector (Indirect)</a></li>
17+
<li><a href="./phishing-legit-iframe-loader.html">Phishing Legit iFrame Loader</a></li>
18+
<li><a href="./phishing-meta-redirect-clean.html">Phishing Redirect via Meta Refresh (Not Flagged in Dataset)</a></li>
19+
<li><a href="./phishing-meta-redirect.html">Phishing Redirect via Meta Refresh (Flagged in Dataset)</a></li>
20+
<li><a href="./phishing-popups.html">Phishing Open via Popups</a></li>
21+
<li><a href="./phishing-url-tampering.html">Phishing Opening with URL Tampering</a></li>
22+
<li><a href="./phishing-form-submission.html">Phishing Form Submission</a></li>
23+
<li><a href="./phishing-iframe-top-navigator.html">Phishing iFrame Top Navigator</a></li>
24+
<li><a href="./phishing-service-worker.html">Phishing Service Worker</a></li>
25+
<li><a href="./phishing-iframe-top-navigator-parent.html">Phishing iFrame Top Navigator Parent</a></li>
26+
<li><a href="/security/badware/phishing-redirect/">HTTP 301 Redirect to Main Phishing Test Page</a></li>
27+
<li><a href="/security/badware/phishing-redirect/302">HTTP 302 Redirect to Main Phishing Test Page</a></li>
28+
<li><a href="/security/badware/phishing-redirect/js">HTTP Redirect to Phishing JS Redirector (Indirect)</a></li>
29+
<li><a href="/security/badware/phishing-redirect/js2">HTTP Redirect to Phishing JS Redirector (Direct)</a></li>
30+
<li><a href="/security/badware/phishing-redirect/iframe">HTTP Redirect to Phishing iFrame Loader</a></li>
31+
<li><a href="/security/badware/phishing-redirect/iframe2">HTTP Redirect to Phishing Legit iFrame Loader</a></li>
32+
<li><a href="/security/badware/phishing-redirect/meta">HTTP Redirect to Clean Meta Refresh Redirector</a></li>
33+
<li><a href="/security/badware/phishing-redirect/meta2">HTTP Redirect to Flagged Meta Refresh Redirector</a></li>
34+
35+
</ul>
36+
</body>
37+
38+
</html>

‎security/badware/phishing-form-submission.html

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<title>Phishing Form Submission</title>
7+
</head>
8+
9+
<body>
10+
<p><a href="./index.html">[Back]</a></p>
11+
12+
<h1>Phishing Page Form Submission</h1>
13+
14+
<p>This is an example page that, although it is not in our phishing dataset, it submits a form to an endpoint that is in our phishing dataset. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our
15+
client blocking is working.</p>
16+
<form method="post" action="/security/badware/phishing-redirect/form">
17+
<input type="hidden" name="phishing" value="true">
18+
<input type="submit" value="Submit">
19+
</form>
20+
</body>
21+
22+
</html>

‎security/badware/phishing-iframe-loader.html

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Phishing page loaded in iframe</title>
6+
</head>
7+
<body>
8+
<p><a href="./index.html">[Back]</a></p>
9+
10+
<h1>Phishing Page iFrame Loader</h1>
11+
12+
<p>This is an example page that, although it is not in our phishing dataset, it loads a test phishing page in an iframe. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our client blocking is working.</p>
13+
<iframe src="https://bad.third-party.site/security/badware/phishing.html" width="100%" height="500" title="Phishing Page"></iframe>
14+
</body>
15+
</html>

‎security/badware/phishing-iframe-top-navigator-parent.html

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Phishing Page iFrame Top Navigator</title>
6+
<script>
7+
if (window.top !== window.self) {
8+
window.top.location.href = "https://bad.third-party.site/security/badware/phishing.html";
9+
}
10+
</script>
11+
</head>
12+
<body>
13+
<p><a href="./index.html">[Back]</a></p>
14+
15+
<h1>Phishing Page iFrame Top Navigator Parent</h1>
16+
17+
<p>This is an example page that, although it is not in our phishing dataset, it loads an iframe that performs a top-navigation to a phishing page. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our client blocking is working.</p>
18+
<iframe src="https://bad.third-party.site/security/badware/phishing-iframe-top-navigator.html" width="100%" height="500" title="Phishing Page"></iframe>
19+
</body>
20+
</html>

‎security/badware/phishing-iframe-top-navigator.html

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Phishing Page iFrame Top Navigator</title>
6+
<script>
7+
if (window.top !== window.self) {
8+
window.top.location.href = "https://bad.third-party.site/security/badware/phishing.html";
9+
}
10+
</script>
11+
</head>
12+
<body>
13+
<p><a href="./index.html">[Back]</a></p>
14+
15+
<h1>Phishing Page iFrame Top Navigator</h1>
16+
17+
<p>This is an example page that, although it is not in our phishing dataset, when iframed, it performs a top-navigation to a phishing page. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our client blocking is working.</p>
18+
19+
</body>
20+
</html>

‎security/badware/phishing-js-redirector-helper.html

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Phishing page with JS redirect loop - helper page</title>
6+
<script>
7+
// eslint-disable-next-line no-unused-vars
8+
window.location = '/security/badware/phishing.html';
9+
</script>
10+
</head>
11+
<body>
12+
<p><a href="./index.html">[Back]</a></p>
13+
14+
<h1>Phishing Page JS Redirects (Direct)</h1>
15+
16+
<p>This is a helper page that is used to redirect to a page that should be classified as phishing. This page itself should not be classified as phishing in our datasets, but since it redirects to a page that is, the error page should still be shown. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our client blocking is
17+
working.</p>
18+
</body>
19+
</html>

‎security/badware/phishing-js-redirector.html

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Phishing page with JS redirect loop</title>
6+
<script>
7+
// eslint-disable-next-line no-unused-vars
8+
window.location = '/security/badware/phishing-js-redirector-helper.html';
9+
</script>
10+
</head>
11+
<body>
12+
<p><a href="./index.html">[Back]</a></p>
13+
14+
<h1>Phishing Page JS Redirects (Indirect)</h1>
15+
16+
<p>This is an example phishing page that attempts to load legitimate iframes to trick the browser into incorrectly classifying the page as legitimate when it should be classed as malware. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our client blocking is
17+
working.</p>
18+
</body>
19+
</html>

‎security/badware/phishing-legit-iframe-loader.html

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta charset="utf-8">
5+
<title>Phishing page loaded in iframe</title>
6+
</head>
7+
<body>
8+
<p><a href="./index.html">[Back]</a></p>
9+
10+
<h1>Phishing Page - iFrame Spoofing</h1>
11+
12+
<p>This is an example phishing page that attempts to load legitimate iframes to trick the browser into incorrectly classifying the page as legitimate when it should be classified as phishing. If you arrive here by mistake; there's nothing to worry about, we just use this page to test if our client blocking is
13+
working.</p>
14+
<iframe src="/" width="100%" height="500" title="Phishing Page"></iframe>
15+
<iframe src="about:blank" width="100%" height="500" title="Phishing Page"></iframe>
16+
</body>
17+
</html>

‎security/badware/phishing-meta-redirect-clean.html

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<!DOCTYPE html>
2+
<html>
3+
4+
<head>
5+
<meta charset="utf-8">
6+
<meta http-equiv="refresh" content="0;url=/security/badware/phishing.html">
7+
<title>Phishing page</title>
8+
</head>
9+
10+
<body>
11+
<p><a href="./index.html">[Back]</a></p>
12+
13+
<h1>Phishing Redirect via Meta Refresh</h1>
14+
15+
<p>This is an example page that loads a phishing page via a meta refresh to test how the browser responds. If you arrive here by mistake; there's
16+
nothing to worry about, we just use this page to test if our client blocking is working.</p>
17+
18+
</body>
19+
20+
</html>

0 commit comments

Comments
 (0)