Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A file that's both an acceptable HTML page and a JPEG (view source on it)

lcamtuf.coredump.cx

Post reply on HN
Print view View original

91–100 of 133 posts

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#91

Post by mkopinsky »

daeken wrote: post #49
crazygringo wrote: post #47

Earlier quoted context omitted.

But almost any site will be sending the image along with a Content-type header, so your browser would still open it up as an image, not an HTML page with JavaScript? Or no?

If you can control the filename, you can do things like embed into an image, put it up as foo.jpg.php, and then execute it by hitting the 'image' directly. That's... sadly common.

Filename validation, I would imagine, is far more common than content validation.

If you are inspecting binary data for validity, and not checking the parameter (filename) that affects how Apache serves your file, you are doing something wrong.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#92

Post by naugtur »

bluesheep wrote: post #85

This is just more evidence that we should strive to do everything in a browser. Or an app that functions like one. It is more secure. Details should not be exposed to the user. Remember there is no file system. In fact, there are no files. We hid them so they do not exist. Out of sight, out of mind. There's no such thing as binary. That only existed when you were younger. Now it no longer exists. The numbers are gone…

I am a html5 JS developer taking part in all this and I happen to share your opinion from time to time. I enjoy using lynx (ok, links2 actually).

Don't worry, there's lots of people who are trying to keep the web worth your attention :)

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#93

Post by scintill76 »

> No server-side hacks involved

Well, the JPEG file doesn't have the correct mime-type. Chrome warns, "Resource interpreted as Image but transferred with MIME type text/html" in the console. Apparently in the context of an URL it figures it out though.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#94

Post by eric_arrr »

AndyKelley wrote: post #71
eric_arrr wrote: post #68

Earlier quoted context omitted.

Yeah, what jack-r-abbit said: the point is you've got malicious script embedded in a page from somebody else's web site, so you have access to cookies and can inspect and/or manipulate the user's session arbitrarily.

Nope, you have an image embedded in somebody else's web site, the script never runs. Also that's completely different than what you originally said.

Andy, you're very confused.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#95

Post by 9k9 »

jack-r-abbit wrote: post #31
daeken wrote: post #16

Earlier quoted context omitted.

Note: Chrome or Firefox with WebGL required. I also wrote an article on how I got this down to 1kb, http://daeken.com/superpacking-js-demos , and just released a new demo based on the same techniques (747 bytes): http://demoseen.com/windowpane/nufl0wer.png.html

Holy Fuck.... that looked really cool as it brought my whole system to a dead stop. Took forever to recover enough to close the tab. :/

I started zooming out and my graphics driver crashed which is quite a rare a occurrence these days.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#96

Post by gwillen »

achal wrote: post #52

I've always wondered how the site snag.gy does something similar. Take this link, for example (you'll have to disable AdBlock if you want to see the ad): http://i.snag.gy/0obAy.jpg (ignore the image itself; it was one of the first to pop up in my history) The source is just the image, and you can embed the image, but there's an ad under the image. Also, right click -> view image or copy image location point to the sa…

I suspect that's doing some kind of autodetection to decide which version of the page to serve. (Perhaps based on what MIME type the browser requests.)
Post reply on HN