Homograph Attack Bypass [ Tested on Linux & Windows ]
Low
Vulnerability Details
##Summary:
at #175286 you has been patched, and i try it work, but i've another way to bypass it. when we add a site to our Homepage with `@`, it's not validate a url properly, make sure it's display the punycode.
##Products affected:
Brave 0.18.36 ( Linux & Windows )
##Steps To Reproduce:
1. In browser add homepage with IDN `@ebаy.com/`
1. now close and open browser again
1. you can see it's redirect to http://xn--eby-7cd.com/
{F221533}
##References:
https://hackerone.com/reports/175286
##Video
https://youtu.be/aCDeZRdRCuk (unlisted)
Actions
View on HackerOneReport Stats
- Report ID: 268984
- State: Closed
- Substate: resolved
- Upvotes: 15