Collected research

Malformed URL in Image Tag Fingerprints Internet Explorer

ha.ckers.org web application security lab - Archive » Malformed URL in Image Tag Fingerprints Internet Explorer

IE refuses to fetch an image whose URL contains a malformed percent escape such as %--, while Firefox and Opera fetch it normally. Loading such an image and observing whether the request arrives fingerprints the real browser without JavaScript, catching User-Agent spoofing. A dropped comment thread narrows the behaviour to IE7 only.

Record

Document

ha.ckers.org web application security lab - Archive » Malformed URL in Image Tag Fingerprints Internet Explorer

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2006 research round

Tags

• browser-fingerprinting
• detection
• url-parsing
• info-leak
• side-channel
• parser-differential
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.