Bugtraq: Re: Internet Explorer and Opera local zone restriction bypass

[Heikki Toivonen <hjtoi () comcast net>]

Mindwarper * wrote:
> If Mozilla or Opera are installed it is also possible to use they're data which is stored in the /Application Data/.
> The only problem is that I will still have to know the username of the victim.
Mozilla user's profile path will have a randomly named directory. See 
below (this on Windows 2000 and XP):
C:\Documents and Settings\<Windows username>\Application 
Data\Mozilla\Profiles\<profile name, usually default>\<random 8 
characters>.slt\
Older Mozilla installations may have slightly different path, but they 
should all still contain that "salted" directory name.
--
  Heikki Toivonen