Top 10 winner

Safari Carpet Bomb

Nitesh Dhanjani · dhanjani.com · 15 May 2008

Safari cannot be configured to ask before downloading, so a page of iframes pointed at a CGI returning an unknown content-type such as blah/blah litters the Windows desktop or ~/Downloads with attacker files. Dhanjani reports Apple's refusal to treat it as a security issue, plus a second finding that Safari applies no sandbox warning to local HTML.

Record

Researcher

Nitesh Dhanjani

Published by

dhanjani.com

Date

15 May 2008

Topic

Browser

In the archive

• Ranked #3 in the 2008 Top 10 Web Hacking Techniques

Tags

• content-type
• mime
• abuse-of-functionality
• iframe
• sandbox-escape
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Nitesh Dhanjani, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.