101–110 of 236 posts
> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?
email money transfer should work fine aka Interac E-Transfer. see http://interac.ca/en/interac-e-transfer-consumer.html
Earlier quoted context omitted.
> as an application security person I will probably never be out of work How many security flaws are the result of malformed HTML?
Malformed HTML may escape sanitization on input in a vulnerable web app, and still render on the victim's browser because their browser wants to be helpful. (Yes, the output should have been escaped, but that is sadly not always the case)
Earlier quoted context omitted.
I'm not an expert on squirrels, but that could be a ground squirrel[1] of some sort. Some varieties of ground squirrel look a lot like chipmunks. [1]: https://en.wikipedia.org/wiki/Ground_squirrel
A quick search for "striped ground squirrel" turned up only one variety, the thirteen-lined ground squirrel. The animal in the photo has stripes like a chipmunk.
This would be a unique way to make downloading images harder.
The HTML file could be one that admonishes the user for attempting to scrape the file, all the while the file they wanted is sitting right there. A modern day Purloined Letter.
That's a chipmunk, not a squirrel.
I'm not an expert on squirrels, but that could be a ground squirrel[1] of some sort. Some varieties of ground squirrel look a lot like chipmunks. [1]: https://en.wikipedia.org/wiki/Ground_squirrel
You can see this in action for yourself on a unix cli: $ curl -o squirrel.html http://lcamtuf.coredump.cx/squirrel/ $ file squirrel.html squirrel.html: JPEG image data, JFIF standard 1.01, comment: " body { visibility: hidden; } .n { visibilit" Open the file in a browser and read the page. Then: $ mv squirrel.html squirrel.jpg Open the renamed file in a browser and only the image appears. I'm not sure what the securi…
there are websites where you can upload files such as images, but they filter html for security reasons. if you can present that html to someone (eg. through deeplinking an iframe to the document), it could contain (or load) javascript that runs in the context of that site...
Earlier quoted context omitted.
> as an application security person I will probably never be out of work How many security flaws are the result of malformed HTML?
Malformed HTML? None. Browsers attempting to be lenient in what they accept? Loads. To take this article as an example, according to the HTTP specification, the `Content-Type` header is supposed to have the final say in what media type is being served. Internet Explorer decided it would be better to use heuristics. I think the idea was that if a web host was misconfigured, rather than have the web developer fix their…
Which kinda worked. The problem was, it opened it up to abuse. If you had a web host that allowed untrusted people to upload images (e.g. profile photos), you could construct an image that tricked Internet Explorer into thinking that it was an HTML document, even if the server explicitly told clients that it was an image. The main difference between images and HTML, of course, is that HTML can contain JavaScript, which would now execute in the security context of your web page. So all of these web hosts, thinking they were only giving people the ability to upload images, were now letting people execute JavaScript on their domain – simply because Internet Explorer tried to be lenient.
This is an interesting example, though I think this is a fair bit different than being lenient on HTML interpretation.
The topic was strict HTML. Accepting malformed HTML doesn't seem to pose much of a problem. Blindly executing a non-executable file seems like a much different problem.
> Netscape interpreting certain Unicode characters as less than signs. People were correctly escaping `
This doesn't sound like being lenient. This just sounds like a bug.
> Browsers ignoring newlines in pseudo-protocols. Want to strip `href="javascript:…"` out of comments? No problem… except some browsers also executed JavaScript when an attacker placed a newline anywhere within the `javascript` token.
Huh? I don't understand the scenario being described here. It again sounds like a bug rather than lenient acceptance of data, though.
Earlier quoted context omitted.
...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r $ file index.html index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: " body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3 I wonder what are the securit…
> I wonder what are the security implications of that. At least any terminal escape sequence can be executed if you run `file` on a JPEG, it seems, since this: curl -s 'http://www.imagemagick.org/image/fuzzy-magick.png' | convert - -set comment "$(printf 'asdf\x1b[1;31mTest?\x1b[0m hmm')" test2.jpg file test2.jpg Results in red text on my terminal for me. (It also results in file writing a 0xff 0xdb to the terminal,…
test2.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, comment: "asdf\033[1;31mTest?\033[0m hmm", baseline, precision 8, 320x85, frames 3That's a chipmunk, not a squirrel.
My University's (Minnesota) mascot is a gopher, but the physical mascot is a chipmunk/squirrel (debated) name Goldy Gopher - but it's definitely not a gopher. These rodents can be confusing!