I appreciate the technical trickery in this version, but has it not been possible to do this since at least 1996[1] by having the server serve different files based on the "Accept" http header?
This JPEG is also a webpage
11–20 of 236 posts
Re: This JPEG is also a webpage
#12...how is that possible?
...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r $ file index.html index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: " body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3 I wonder what are the securit…
Might be a way to bypass malicious script detectors that see the JPEG header and stop trying to process the file.
It will be stopped dead by metadata filters though. Stripping out the comment would be step #1 for those devices.
Re: This JPEG is also a webpage
#13So in theory, can analytics platforms be compromised so that JPEG tracking pixels could turn into full-fledged sites interfering with the parent page at, say, a bank website? Firing off credentials in the background?
Re: This JPEG is also a webpage
#14...how is that possible?
...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r $ file index.html index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: " body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3 I wonder what are the securit…
I remember HTML parser was standarized in WHATWG. I guess it never gives up and keeps trying to find valid HTML tags
Re: This JPEG is also a webpage
#15So in theory, can analytics platforms be compromised so that JPEG tracking pixels could turn into full-fledged sites interfering with the parent page at, say, a bank website? Firing off credentials in the background?
No, because if parsed as a JPEG, arbitrary code wont be run. If the jpeg was somehow parsed as JS, then possibly yes.
Re: This JPEG is also a webpage
#16...how is that possible?
...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r $ file index.html index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: " body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3 I wonder what are the securit…
> I wonder what are the security implications of that.
At least any terminal escape sequence can be executed if you run `file` on a JPEG, it seems, since this:
curl -s 'http://www.imagemagick.org/image/fuzzy-magick.png' | convert - -set comment "$(printf 'asdf\x1b[1;31mTest?\x1b[0m hmm')" test2.jpg
file test2.jpg
(It also results in file writing a 0xff 0xdb to the terminal, which the terminal turns into the unicode fallback character since it's not valid text…)
Re: This JPEG is also a webpage
#17Earlier quoted context omitted.
...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r $ file index.html index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: " body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3 I wonder what are the securit…
Might be a way to bypass malicious script detectors that see the JPEG header and stop trying to process the file. It will be stopped dead by metadata filters though. Stripping out the comment would be step #1 for those devices.
What device would have metadata filters installed though? Not a modern browser, by default.
Re: This JPEG is also a webpage
#18great hack, could you get javascript working inside a jpeg as well? Or obfuscate the javascript and decrypt in the browser for steganographic purposes?
[deleted]
Re: This JPEG is also a webpage
#19I didn't know what he was talking about until I tried this:
data:text/html,
Re: This JPEG is also a webpage
#20great hack, could you get javascript working inside a jpeg as well? Or obfuscate the javascript and decrypt in the browser for steganographic purposes?
No, the JPEG header is at the start of the file, unlike the PNG which is at the bottom.