Hi, Sorry if this is not new, but I didn't manage to find any mention of such a technique.
In short: HTTP referer field contains information where the web user is coming from, which is often a trusted site such as a web search. Having such information, a malicious web site can use several tricks to fool the user into thinking that he or she returned to the referring site. In fact, the user is taken to a generic phishing site that intercepts all data exchanged between the user, the referring site and sites visited from the referring site. More detailed write up with few examples is here: http://mixedbit.org/referer.html Cheers, Jan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/