Other nomination

Filejacking: How to make a file server from your browser (with HTML5 of course)

WebKit's directory upload control lets a page read a whole folder, and users get no warning that a folder picker is not a save dialog. Kotowicz hid a transparent directory input over a fake download button, then opened a second window that survived the first being closed, uploaded the file listing and a sample image, and polled a control panel for further file requests.

In the archive

• Nominated for the 2011 Top 10 Web Hacking Techniques

Related sources

• Companion demonstration

Tags

• ui-redress
• clickjacking
• file-upload
• javascript
• info-leak
• xss
• dom
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.