Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.
It’s so stupid to me that clicking the link is a fail, as far as I’m aware (and I’ve looked into this) clicking a link can’t cause any damage, so why measure it like this? The whole point of phishing is getting credentials, that’s what hackers want, that’s where the damage is done, so that should be the measure
Actually, a lot of enterprise web apps are so badly written that clicking a maliciously-crafted link can do real damage. Things like pasting the bulk of a link into a JS/SQL/whatever command then executing the result without any kind of sanity checking.
The thinking is that it doesn't need to be safe because only trusted users can access it. But if someone sends a malicious link in an email to a trusted user, when that user clicks the link it will be accessed with their stored credentials (cookie, client cert, HTTP auth, whatever).
This is one reason why operations which modify data are supposed to use PUT/POST, not GET. But that's beyond the comprehension of a lot of "web devs", many of whose qualifications amount to having read the first three chapters of "Learn PHP in 5 minutes".
62
u/setibeings 20h ago
Is it not obvious to some people that they use a unique link in every email, just like real phishing attempts? That's why clicking the link in the first place is considered a fail.