Top 10 winner

HTML5 Hard Disk Filler™ API

Feross Aboukhadijeh · feross.org

The Web Storage spec asks browsers to stop affiliated sites pooling localStorage quota, but Chrome, Safari and IE enforced the limit strictly per origin. Writing from many subdomains of one domain therefore gave a page unbounded disk use; the filldisk.com demo wrote about 1 GB every 16 seconds. Firefox capped storage per domain and was unaffected.

Record

Researcher

Feross Aboukhadijeh

Published by

feross.org

In the archive

• Ranked #10 in the 2013 Top 10 Web Hacking Techniques

Related sources

• Demonstration source

Tags

• dos
• javascript
• same-origin-policy
• case-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Feross Aboukhadijeh, first published at the original source. Preserved copies are kept so the citation survives its host.