Other nomination

File System API with HTML5 -- Juice for XSS

shreeraj · shreeraj.blogspot.com

Short note on the HTML5 File System API as an XSS target. Because a site can create a persistent mini filesystem readable by any script in the same origin, an XSS payload can enumerate the entries and read files such as stored tokens. Screenshots show the created files listed in Chrome and the JavaScript access routine.

Record

Researcher

shreeraj

Published by

shreeraj.blogspot.com

In the archive

• Nominated for the 2012 Top 10 Web Hacking Techniques

Tags

• xss
• javascript
• info-leak
• dom
• same-origin-policy
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of shreeraj, first published at the original source. Preserved copies are kept so the citation survives its host.