Collected research
Gravatar Email Enumeration in JavaScript
Gravatar serves avatars keyed by the MD5 of an email address and can be told to return no image, so a page can load candidate hashes and read back the rendered image size cross-origin. A script builds addresses from a first name, last name and company domain plus common webmail hosts, confirming valid ones in the visitor's browser without any request from the attacker.
Record
- Researcher
- Robert Hansen
- Published by
- blog.whitehatsec.com
- Topic
- Server
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Robert Hansen, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .