Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A file that's both an acceptable HTML page and a JPEG (view source on it)

lcamtuf.coredump.cx

Post reply on HN
Print view View original

21–30 of 133 posts

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#21

Post by shuzchen »

ejdyksen wrote: post #14
agwa wrote: post #9

Earlier quoted context omitted.

The HTML document is in the "comment" field of the JPEG, which is perfectly reasonable. What is surprising is that web browsers just ignore the 24 bytes of binary data between the start of the file and the start of the HTML.

That extra binary data starts with an HTML comment tag ( Edit: Misread your comment...the bytes at the beginning of the file are hidden by CSS (as pointed out by others).

Commenter is referring to the binary data at the beginning of the file, which makes up the file header for the jpeg. It is before the tag and is neither commented out or actually ignored.

The browser actually picks that "text" up and shows it on page. It's just the html content itself contains some css rule to make that text not visible.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#22

Post by dunham »

agwa wrote: post #9
younata wrote: post #4

Earlier quoted context omitted.

view source shows that he has an html document embedded in the jpeg. Apparently, the jpeg format allows this.

The HTML document is in the "comment" field of the JPEG, which is perfectly reasonable. What is surprising is that web browsers just ignore the 24 bytes of binary data between the start of the file and the start of the HTML.

It's interpreting that data as "text" and sticking it at the beginning of the of the document. The css makes the body invisible so you don't see it on the screen (unless you disable that rule) - take a look in the DOM inspector.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#24

Post by jack-r-abbit »

agwa wrote: post #9
younata wrote: post #4

Earlier quoted context omitted.

view source shows that he has an html document embedded in the jpeg. Apparently, the jpeg format allows this.

The HTML document is in the "comment" field of the JPEG, which is perfectly reasonable. What is surprising is that web browsers just ignore the 24 bytes of binary data between the start of the file and the start of the HTML.

As pointed out by someone else, the browser has been instructed via CSS to hide the body. If you inspect the page and manipulate the CSS to show the body, those odd bytes (ÿØÿàJFIF,,ÿþr) do get rendered.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#25

Post by WiseWeasel »

rescripting wrote: post #12

Perhaps I don't know enough about how this works, but couldn't you use this to inject runnable javascript in to a page? If this is possible it's pretty scary as it would allow you to upload a hidden payload in to an otherwise innocent looking image.

I was able to add javascript code in there and it executed properly, but the browser won't parse the jpg as html unless I give it a .html filename extension. I don't see how this could be easily exploitable.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#26

Post by subleq »

rescripting wrote: post #12

Perhaps I don't know enough about how this works, but couldn't you use this to inject runnable javascript in to a page? If this is possible it's pretty scary as it would allow you to upload a hidden payload in to an otherwise innocent looking image.

Yes, certain versions of IE can be tricked into executing javascript in images: http://www.h-online.com/security/features/Risky-MIME-sniffin...

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#30

Post by kpi »

rescripting wrote: post #12

Perhaps I don't know enough about how this works, but couldn't you use this to inject runnable javascript in to a page? If this is possible it's pretty scary as it would allow you to upload a hidden payload in to an otherwise innocent looking image.

Interesting thought but browsers should not interpret javascript inside an image. I would expect image rendering to be separated. Can someone with an expertise in browser design tell us how this actually works?
Post reply on HN