XSS-FP: Browser Fingerprinting using HTML Parser Quirks

Erwan Abgrall (1, 2) , Yves Le Traon (1, 3) , Martin Monperrus (4) , Sylvain Gombault (5) , Mario Heiderich (6) , Alain Ribault (7)

1 Uni.lu - Université du Luxembourg
2 KEREVAL
3 S'nT - Security, Reliability and Trust Interdisciplibary Research Centre
4 ADAM - Adaptive Distributed Applications and Middleware
5 RSM - Département Réseaux, Sécurité et Multimédia
6 RUB - Ruhr University Bochum = Ruhr-Universität Bochum
7 KEREVAL

There are many scenarios in which inferring the type of a client browser is desirable, for instance to fight against session stealing. This is known as browser fingerprinting. This paper presents and evaluates a novel fingerprinting technique to determine the exact nature (browser type and version, eg Firefox 15) of a web-browser, exploiting HTML parser quirks exercised through XSS. Our experiments show that the exact version of a web browser can be determined with 71\% of accuracy, and that only 6 tests are sufficient to quickly determine the exact family a web browser belongs to.

Domaines: Cryptographie et sécurité [cs.CR]; Génie logiciel [cs.SE]

Erwan Abgrall, Yves Le Traon, Martin Monperrus, Sylvain Gombault, Mario Heiderich, et al.. XSS-FP: Browser Fingerprinting using HTML Parser Quirks. [Research Report] 12888, SnT. 2012. ⟨hal-00753926⟩