Live data from Hacker News

A file that's both an acceptable HTML page and a JPEG (view source on it)

lcamtuf.coredump.cx

11–20 of 133 posts

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#12
Perhaps I don't know enough about how this works, but couldn't you use this to inject runnable javascript in to a page? If this is possible it's pretty scary as it would allow you to upload a hidden payload in to an otherwise innocent looking image.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#13
post #5

I guess the HTML renderer skips the JPEG information and the image renderer skips the HTML information. Smart!

The CSS on the page makes the JPEG header (html body) invisible:

body { visibility: hidden; } .n { visibility: visible; position: absolute; padding: 0 1ex 0 1ex; margin: 0; top: 0; left: 0; }

the html portion comments the remaining part of the data with <!--

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#14
post #9
post #4

Earlier quoted context omitted.

view source shows that he has an html document embedded in the jpeg. Apparently, the jpeg format allows this.

The HTML document is in the "comment" field of the JPEG, which is perfectly reasonable. What is surprising is that web browsers just ignore the 24 bytes of binary data between the start of the file and the start of the HTML.

That extra binary data starts with an HTML comment tag (Edit: Misread your comment...the bytes at the beginning of the file are hidden by CSS (as pointed out by others).

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#15

If you think that's cool, look at Daeken's Magister: http://demoseen.com/windowpane/magister.png.html A PNG that's interpreted as HTML and loads itself as compressed JavaScript!

Another one is Matraka: http://www.p01.org/releases/MATRAKA/matraka.png.html

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#16

If you think that's cool, look at Daeken's Magister: http://demoseen.com/windowpane/magister.png.html A PNG that's interpreted as HTML and loads itself as compressed JavaScript!

Note: Chrome or Firefox with WebGL required. I also wrote an article on how I got this down to 1kb, http://daeken.com/superpacking-js-demos , and just released a new demo based on the same techniques (747 bytes): http://demoseen.com/windowpane/nufl0wer.png.html

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#18

If you think that's cool, look at Daeken's Magister: http://demoseen.com/windowpane/magister.png.html A PNG that's interpreted as HTML and loads itself as compressed JavaScript!

Another one is Matraka: http://www.p01.org/releases/MATRAKA/matraka.png.html

Matraka is seriously worth a watch. All 2d canvas, and it actually has music in a 1k. What's funny is that p01 is the reason I got into web demo development, and he's actually using the png technique I came up with. Makes me proud to be a hacker.

Edit: It also won a much-deserved first place in the DemoJS 1k compo.

Post reply on HN