Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For example:

  • Accessing a website with javascript enabled can expose information such as browser, fonts and local time. Can it, theoretically, expose your Windows or Linux username?

  • Will saving a file or attaching a file (as normally done by webmails) expose your Windows or Linux username, by accessing your directory tree?

Can the username we use to log-in to operating systems be exposed to websites in some way?

share|improve this question
    
Why the two downvotes? –  Strapakowsky May 31 '13 at 7:57
    
Without exploiting the browser, nope. But browser exploits are rife. –  lynks May 31 '13 at 11:50
    
If you upload an MS Office document, it might contain the username in its metadata. This is probably true for some other filetypes too. –  davidwebster48 Jun 15 '13 at 22:14
add comment

1 Answer

The username is not commonly exposed to websites. Perhaps it can be done with Java in some way, but not by the browser by default. Note that I mean Oracle's Java, not Javascript!

Some websites use Active Directory authentication. If you visit one with Internet Explorer that runs in the same Windows domain as your computer is in, you'll automatically be logged in. This uses some form of HTTP-level authentication and transmits your domain, username and the computer's hostname. Your password is not transmitted; the browser only answers a challenge from the server and proves its identity that way.

Internet Explorer only sends this info (username, domain and hostname) after the server has sent a challenge as well as the domain, and the domain matches the client's domain. For example if the server advertises that it is running domain Contoso and the user is also logged in to the domain Contoso, then Internet Explorer will proceed with authentication and provide a username, domain, hostname and challenge response, where the challenge response is a password substitute.

If the domain does not match, for example the server advertises to belong to Contoso2, the user will be prompted for credentials (username and password). If the users enters these credentials, the username will of course be sent to the server, together with your hostname. The password is still confirmed by a challenge, this is never sent. Note that even if you enter a blank username and password, your hostname will still be exposed! The only safe exit is the cancel button.

The only way to retrieve the username automatically, as far as I've been able to find, is by knowing the domain that the user is logged in at, and having the user use Internet Explorer. I suppose the domain name is often guessable, so high-profile targeted phishing might be possible. Then again, you can never retrieve the user's password automatically, merely the username and hostname, so I'm not sure how useful this is. Perhaps to make a targeted phishing attack even more personal.

Another method to obtain the username is by this ActiveX control:

<script type="text/javascript">
alert(new ActiveXObject("WScript.Network").UserName);
</script>

Testing this in Internet Explorer 9, it gives two warnings. First of all a warning on the bottom of the screen that asks whether I want to activate ActiveX components on the page, and a second warning asks whether I'm really sure because it might be harmful. With some social engineering you might trigger the username this way... but there are probably easier ways.

Other browsers such as Firefox always prompt for a username and password when visiting such websites. I think this data is sent unencrypted, but I haven't looked that up. Best is to always use transport layer security (e.g. https) when performing any sort of authentication. But this kind of authentication is not automatic, so probably not relevant for your question.

Update: Something I forgot to address that you asked was whether the username can be exposed when selecting files with the input type=file element. In short: no. Older browsers might do this, but in recent versions of Chrome, Firefox and IE9 I've tested it and none of them expose the full path. In Firefox you might notice the mozFullPath property, but this returns an empty string when Javascript tries to access it. Only code with special privileges (I imagine such as add-ons) can use this. Also the HTML5 file API specification mentions the word "path" only once, to tell that it should not be exposed.


Disclaimer: Much of the Active Directory stuff was simply tested, there might be mistakes. I have two domains here so that makes it easy to see the behavior with Wireshark when you log into either the own or the other domain. I used IE9 for the client, and Windows Server 2008 for the server. I also used another test server (php) based on this script: http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/

share|improve this answer
    
So, if for example you use Firefox and attach a file to send in an email, won't the directory you're using to attach the file from be exposed (and probably your username with it, eg if it's /home/strapakowsky/contracts/contract1.pdf)? –  Strapakowsky Jun 14 '13 at 7:15
    
@Strapakowsky Nope, the path is not exposed to Javascript. Maybe some obscure browser, but recent versions of Chrome, Firefox and IE9 only expose the filename, never the path. Or at least, I don't know of any hacks that make it possible. –  Luc Jun 14 '13 at 8:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.