Other nomination

Malformed URL in Image Tag Fingerprints Internet Explorer

IE refuses to fetch an image whose URL contains a malformed percent escape such as %--, while Firefox and Opera fetch it normally. Loading such an image and observing whether the request arrives fingerprints the real browser without JavaScript, catching User-Agent spoofing. A dropped comment thread narrows the behaviour to IE7 only.

In the archive

• Nominated for the 2006 Top 10 Web Hacking Techniques

Tags

• browser-fingerprinting
• detection
• url-parsing
• info-leak
• side-channel
• parser-differential
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.