(03-23-2025, 02:16 PM)Exploit0000 Wrote: Is it possible to infect machines just by creating a website, where when people visit it, malware is installed without any visible installation process? Or can it simply steal cookies, usernames, and passwords from the person's browser just by them entering the site, without needing to download or execute anything other than opening the URL?
I would say, technically yes, but VERY VERY unlikely, since it needs a 0-day vulnerability in the browser, but something like csrf could occur though, so when you go to the attackers website, that website uses javascript to request some action on an another website, because browsers automatically send cookies if you have them stored, so like if a bank has very shit security, it could send the attacker money once you click on the link, or maybe delete your account on an another platform once you click the link