iframe, make someone see their own hard drive

I noted a neat trick a while ago, somthing similar to

<p><iframe src="file:///C:/" width=100% height=130%></iframe></p>
        
</td>
		</tr>
			</table>


              </td>
            </tr>
          </table>
        </td>
       

Code (markup):

It is supposed to scare your visitors, by seeing their C Drive on the internet. However, when I put it on a page, its not working properly. Is the code all right?

 

where did you find this originally?

 

Hello,
You are referring to a simple link like <A HREF="file://c:/">Click me</a> or however you would do it. You could type file://c:/ into your web browser to see your drive but as far as I know, no other method works. Think about it. If you add someones drive to an IFrame source I would have total access to all files in that folder. Stealing data from an IFrame requires only a simple javascript command like
var stoleninfo = document.IFRAMENAME.src;
this would take the list, and from there I could do whatever I wanted. It's a major security breach which is why it doesnt work with href or as an iframe source. Your code is correct to perform on yourself locally, it wont work because of 2 reasons. Once you upload the file, file://c:/ becomes the c drive on the server, and #2 it isnt physically being typed into the address bar.
Mike