Other nomination
File Download Injection
Aspect Security whitepaper on injecting a whole file download through a Content-Disposition header. Two CRLFs in a download script's filename parameter terminate the headers and let the attacker supply arbitrary file name, type and body, served from the trusted domain the victim clicked.
Record
- Researcher
- Jeff Williams
- Format
- Whitepaper
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Jeff Williams, first published at the original source. Preserved copies are kept so the citation survives its host.