Other nomination
SMB Decloaking
An iframe pointing at a file:// UNC path makes Internet Explorer open an SMB connection to the attacker's host, which a packet capture reads for the real username, IP address, computer name and service pack. It needs no user interaction; the author estimates about half of networks allow outbound SMB.
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.