Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A file that's both an acceptable HTML page and a JPEG (view source on it)

lcamtuf.coredump.cx

Post reply on HN
Print view View original

41–50 of 133 posts

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#41

Post by duskwuff »

aidanns wrote: post #10
habosa wrote: post #2

Can someone explain what is going on here?

The file has been created in such a way that the web browser is ignoring the non-html parts of the document, while the image renderer is ignoring the parts that make up the html page. The first part probably isn't too hard, since most web browsers go to great lengths to render non-standard html in a sensible way, I'm not too sure about the second part. I'm guessing the jpeg spec has some variable length space in some…

> I think it was called a Jafar attack

GIFAR: http://en.wikipedia.org/wiki/GIFAR

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#42

Post by eric_arrr »

You can also use this trick to launch cross-site script attacks against sites that allow you to upload images.

Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it.

Step 2: point your victim back to the uploaded "image" as though it's actually a page, and presto!, it's a page -- a page with malicious javascript in it.

Step 3: profit!

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#47

Post by crazygringo »

eric_arrr wrote: post #42

You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…

But almost any site will be sending the image along with a Content-type header, so your browser would still open it up as an image, not an HTML page with JavaScript? Or no?

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#48

Post by naugtur »

seanconaty wrote: post #19

Any practical use for this or just for fun?

I posted my comment right before spotting your question... I Used a trick like that to be able to load my posterous posts with JSONP. http://zbyszek.posterous.com is loaded as content in http://naugtur.pl

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#49

Post by daeken »

crazygringo wrote: post #47
eric_arrr wrote: post #42

You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…

But almost any site will be sending the image along with a Content-type header, so your browser would still open it up as an image, not an HTML page with JavaScript? Or no?

If you can control the filename, you can do things like embed into an image, put it up as foo.jpg.php, and then execute it by hitting the 'image' directly. That's... sadly common.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#50

Post by AndyKelley »

eric_arrr wrote: post #42

You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…

Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.
Post reply on HN