Well, eventully, i started play around with some JS.

I suppose this method is rather old, but i havn’t seen it around (strangely)..

The exploit is a simple javascript “onclick” event on an “<a>” tag, which changes the “href” value to another site.

<a href=”http://www.good.com” id=”s”

onclick=”document.getElementById(’s’).href=’http://www.evil.com’;”>

http://www.good.com</a>

And here’s the proof of concept: http://www.good.com enjoy!