Я новый в этом деле и хотел спросить
Насколько эффективный пуш увидомления и стоит ли его подключать на свой или чужой сайт?
Насколько эффективный пуш увидомления и стоит ли его подключать на свой или чужой сайт?
-
XSS.stack #1 – первый литературный журнал от юзеров форума
Пуш уведомления
- Автор темы Novenki
- Дата начала
push notification can be useful, like when they are pushed rapidly and users accidentally click it when it appears over link/button they meant to click on page instead.
you could simulate fake windows warnings, but if you have the ability to insert javascript already, there are better options to pursue depending on the website.
but you question is vague, so it is hard to answer directly without knowing more information. there are notifications via malicious mobile calendar add-ons, notifications from browser extensions, notification from maldvertisments, etc. please be more clear about your question.
Не уверен, что понимял вопрос. Любой сайт по идее должен иметь систему уведомлений, только применять ее надо по умному
- Автор темы
- Добавить закладку
- #5
Извиняюсь за не точный вопрос и если точнее то стоит или угублятся в этой теме? потому что на форуме мало видел постов по этому поводу и вот думаю может оно не сильно актуально особенно для новичков
и большая ли сложно сделать такое увидомления что бы не детектилось и люди могли даже случайно на него нажать ?
can you show an image example of the type of notification you're talking about? if you are talking about browser notifications, they can be useful for many things. if used properly, you can phish users and lead them to install malware. the problem is most people click "deny" on them, so when they are spammed the user might accidentally click "allow" for notification. if you are creative and use the notifications for pushing malware or phishing in a way like not everyone already does, then you will have success. but push notifications are usually considered a nuisance by most users, but done right they can be very successful.
thank you for clarifying. most people will not click it without a good reason. even if they do, the notifications are usually seen as a nuisance and users will look for ways to disable them if they enabled it. from research, they can be useful for phishing as discussed in this paper about malicious browser notifications.
i would recommend to push malicious browser extensions as you would have more control and your malicious javascript will be able to embed into cross site elements.
i have seen malicious advertisements spam notifications in an attempt to get the user to accidentally click "allow" when attempting to click on the page behind the notification alert. i also know for mobile users that custom calendar events are a way to send notifications and see them often, which means they are somewhat successful. otherwise, they wouldn't be attempting to continue to spam them.
you can see about malicious calendar events here: https://www.malwarebytes.com/blog/news/2021/05/iphone-calendar-spam-attacks-on-the-rise/amp
in the end, anything can be used to help your campaign if it is done creatively and original (not like everyone else).