Top 10 winner

Backdooring QuickTime Movies

pdp · GNUCITIZEN · 5 September 2006

pdp shows a QuickTime HREF Track can carry a javascript: URL that fires automatically when the movie is previewed in a browser, relying on a feature present since QuickTime 3 rather than on a bug. Step by step: write the one-line text track A<javascript:alert(...)> T<>, paste it into Sample.mov with QuickTime Pro, then rename the track to HREFTrack.

Record

Researcher

pdp

Published by

GNUCITIZEN

Date

5 September 2006

Topic

HTTP

In the archive

• Ranked #5 in the 2006 Top 10 Web Hacking Techniques

Tags

• xss
• javascript
• file-upload
• sop-bypass
• mime
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of pdp, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.