Sergey Vzloman is at it again… He sent over a really interesting piece of demo code (he tested it in IE6.0 and FF - I was only able to test it in Firefox) that enumerates users on Windows systems. Right now, as the code stands in his demo (with only minor tweaks from me) it only tries four accounts and is intentionally noisy to show what it’s doing, but it works pretty well Click here to see the demo.
Dan Veditz has already commented on this saying the resource:// issue is already fixed in 220.127.116.11 and 18.104.22.168 versions of Firefox. But for now and for previous versions, this will continue to work. It may be a little slow to enumerate users, but if you know it’s one of a few hundred combinations of a user’s name you can quickly enumerate through it.
Of course there are other ways to do this, like get them to connect to you through a file:///\\ URL as discussed before, but it’s good to have all of this documented since one or more of these may stop working. Nice work, Sergey!