internet explorer madness

Re: internet explorer madness

Albino — Mon, 23 Apr 2012 07:24:34 -0500

Seems like it's related to security zones; the poc only works if it's in the trusted/local security zone. Ah well.

Re: internet explorer madness

infinity — Wed, 11 Apr 2012 15:48:15 -0500

Which version of the internet explorer are you using?

I have uploaded an HTML page with your code, using the stylesheet from my website, on a completely different domain on a different IP address. And I have the same page on my local Apache, using the same stylesheet from the web. The third possibility is to open the file locally.

All three possibilities seem to work with Internet Explorer 9, but I had to confirm something about the intranet configuration when requesting the file from the localhost Apache.

No problem with Internet Explorer 5.5 and 6, but I can't get any of the three possibilities to work with IE 7. These older versions are not running stable on my system and tabs crash frequently.

Apparently it does not work with the current Firefox and an older Version of K-Meleon, but all versions (local as file, local on my Apache and hosted on a domain) work with Opera 11.62.

One difference to your example is that my stylesheet is not requested through https, but ordinary http. So I have changed the test page to use a stylesheet from an https site. But still all three possibilities work in IE9 and the current version of Opera.

I hope that this information helps. :-)

Re: internet explorer madness

Anonymous User — Wed, 11 Apr 2012 15:09:12 -0500

When you say host it anywhere breaks it, Im assuming you mean on the net.

I spun up IIS and atleast using my local IP, I am still able to fire off the alert.

internet explorer madness

Albino — Wed, 11 Apr 2012 14:02:42 -0500

I have a page that loads a third party stylesheet and alert()'s some info from it. For some reason it only works if I open it locally; hosting the page anywhere breaks it.

Here's the code:

I've looked at the HTTP requests in burp and they appear to be identical, except that the local one is missing the Referer header since it's cross-protocol.

I've tried changing the doctype & turning quirks mode on and off to to avail. Any ideas?