51–60 of 133 posts
The source is just the image, and you can embed the image, but there's an ad under the image. Also, right click -> view image or copy image location point to the same URL.
You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…
Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.
Earlier quoted context omitted.
I was able to add javascript code in there and it executed properly, but the browser won't parse the jpg as html unless I give it a .html filename extension. I don't see how this could be easily exploitable.
Is it possible for the file extension to say one thing and the MIME type to say something else? So the file extension could be .jpg (reassuring the user that it is only an image) but the HTTP response says it is text/html? I think a similar exploit was used recently with .svg images - they can contain javascript (being XML) which will be executed by the browser. Not sure about the details however.
However, the JavaScript shouldn't execute if the image is embedded via .
Any practical use for this or just for fun?
There was a 'virus' that spread on 4chan years ago that did something like this. AFAIK when saved as a .js file and run it would post itself back 4chan to continue spreading.
Earlier quoted context omitted.
Note: Chrome or Firefox with WebGL required. I also wrote an article on how I got this down to 1kb, http://daeken.com/superpacking-js-demos , and just released a new demo based on the same techniques (747 bytes): http://demoseen.com/windowpane/nufl0wer.png.html
Holy Fuck.... that looked really cool as it brought my whole system to a dead stop. Took forever to recover enough to close the tab. :/
http://cs.unm.edu/~eschulte/data/webpage.html
download webpage.html and it should run on any 64-bit linux machine as an executable printing out the same text shown on the web page. Here's the C file used to compile the original executable, nothing exciting...
Reminds me of this story (JPEG and ZIP as one file): http://www.reddit.com/comments/arc79/reddit_i_got_the_best_p...
Here's the same thing done with a compiled executable using the padding bits in an ELF file. http://cs.unm.edu/~eschulte/data/webpage.html download webpage.html and it should run on any 64-bit linux machine as an executable printing out the same text shown on the web page. Here's the C file used to compile the original executable, nothing exciting... http://cs.unm.edu/~eschulte/data/webpage.c
