Other nomination

HTTP Response Splitting and Data: URI scheme in Firefox

Stefano Di Paola

Stefano Di Paola chains HTTP response splitting into a data: URI XSS on Firefox. A redirector vulnerable to splitting is made to emit a Refresh header pointing at data:text/html with script in it, and Firefox executes that script in the redirecting site's context, extending pdp's data: URI concerns and Amit Klein's Refresh header work.

Record

Researcher

Stefano Di Paola

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• response-splitting
• header-injection
• xss
• http
• filter-bypass
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host.