Collected research

Res Timing File Enumeration Without JavaScript in IE7.0

ha.ckers.org web application security lab - Archive » Res Timing File Enumeration Without JavaScript in IE7.0

Combines David Byrne's res:// timing trick with Jeremiah Grossman's META-refresh blocking via link tags to enumerate local files in Internet Explorer 7 with no JavaScript at all. Present and absent files differ by five to fifteen seconds, visible to the naked eye; the catch is keeping it running while the browser appears locked up. Working demo linked (IE7 only).

Record

Document

ha.ckers.org web application security lab - Archive » Res Timing File Enumeration Without JavaScript in IE7.0

Published by

ha.ckers.org

Topic

Server

In the archive

• Collected in the 2008 research round

Related sources

• RES timing file enumeration

Tags

• timing-attack
• side-channel
• xsleak
• info-leak
• browser-fingerprinting

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.