Other nomination

Res:// Protocol Local File Enumeration

xssniper

Internet Explorer's built-in res:// protocol reads resources out of local DLLs and executables, so a remote page can probe for a given file and report back whether it exists. That enumerates installed software and often its exact version, letting an attacker select targeted exploits. The file need not be installed, only present.

Record

Researcher

xssniper

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Related sources

• Companion proof-of-concept
• Research paper

Tags

• info-leak
• url-parsing
• browser-fingerprinting
• cve
• detection
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of xssniper, first published at the original source. Preserved copies are kept so the citation survives its host.