Top 10 winner

Abusing HTML 5 Structured Client-side Storage

Alberto Trivero · SecDiscover · 20 July 2008

Session, global, local and Database Storage have no HTTPOnly, no path scoping and no port scoping, so one XSS anywhere on a host reads all of it. Enumerate keys with for(i in sessionStorage), find databases by testing window[i]=="[object Database]", pull schema from sqlite_master, then exfiltrate with the HTML5CSdump script given in full. Covers cross-directory, cross-domain and client-side SQLi.

Record

Researcher

Alberto Trivero

Published by

SecDiscover

Date

20 July 2008

Format

Whitepaper

Topic

Browser

In the archive

• Ranked #6 in the 2008 Top 10 Web Hacking Techniques

Tags

• xss
• sqli
• info-leak
• javascript
• dom
• same-origin-policy
• database
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Alberto Trivero, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.