Collected research

Content Smuggling

Billy (BK) Rios » Content Smuggling

Billy Rios · xs-sniper.com

The PDF specification lets the header appear anywhere in the first 1024 bytes, so a file can be a valid GIF and a valid PDF at once. Uploading such a polyglot to a site that only accepts benign types, then referencing it through an OBJECT tag with an application/pdf content type, hands it to Adobe Reader, whose XML APIs then make cookie-bearing requests against the hosting origin.

Record

Document

Billy (BK) Rios » Content Smuggling

Researcher

Billy Rios

Published by

xs-sniper.com

Topic

Other

In the archive

• Collected in the 2012 research round

Tags

• file-upload
• xss
• pdf
• content-type
• parser-differential
• same-origin-policy
• filter-bypass
• mime
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Billy Rios, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.