A file that's both an acceptable HTML page and a JPEG (view source on it) • Hacker News Board

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#31

Post by jack-r-abbit » Fri, Jul 06, 2012, 7:36 PM UTC

daeken wrote: post #16

greyfade wrote: post #11

If you think that's cool, look at Daeken's Magister: http://demoseen.com/windowpane/magister.png.html A PNG that's interpreted as HTML and loads itself as compressed JavaScript!

Note: Chrome or Firefox with WebGL required. I also wrote an article on how I got this down to 1kb, http://daeken.com/superpacking-js-demos , and just released a new demo based on the same techniques (747 bytes): http://demoseen.com/windowpane/nufl0wer.png.html

Holy Fuck.... that looked really cool as it brought my whole system to a dead stop. Took forever to recover enough to close the tab. :/

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#32

Post by techtalsky » Fri, Jul 06, 2012, 7:36 PM UTC

ams6110 wrote: post #29

Looks more like a chipmunk to me.

I think it's a 13-lined ground squirrel. Commonly mistaken for a chipmunk. Not all squirrels have bushy tails.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#33

Post by jbee » Fri, Jul 06, 2012, 7:51 PM UTC

This trick does not work correctly in IE9, due to the unclosed comment tag.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#34

Post by Domenic_S » Fri, Jul 06, 2012, 7:52 PM UTC

mathias wrote: post #17

I don’t have GraphicsMagick installed on this machine, else I would try this: $ gm convert http://lcamtuf.coredump.cx/squirrel/ -comment '' x.jpg …and… $ gm identify -format '%c' http://lcamtuf.coredump.cx/squirrel/

is apt-get/yum not working for you?

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#35

Post by pubby » Fri, Jul 06, 2012, 7:55 PM UTC

seanconaty wrote: post #19

Any practical use for this or just for fun?

There was a 'virus' that spread on 4chan years ago that did something like this. AFAIK when saved as a .js file and run it would post itself back 4chan to continue spreading.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#36

Post by StavrosK » Fri, Jul 06, 2012, 7:56 PM UTC

daeken wrote: post #18

denysonique wrote: post #15

Earlier quoted context omitted.

Another one is Matraka: http://www.p01.org/releases/MATRAKA/matraka.png.html

Matraka is seriously worth a watch. All 2d canvas, and it actually has music in a 1k. What's funny is that p01 is the reason I got into web demo development, and he's actually using the png technique I came up with. Makes me proud to be a hacker. Edit: It also won a much-deserved first place in the DemoJS 1k compo.

Wait, is it using the image data as code to evaluate? My mind is too blown to appreciate this.

EDIT: Oh, okay. It's not a valid PNG. That would have been all sorts of incredible. Still great, though.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#37

Post by dmauro » Fri, Jul 06, 2012, 8:03 PM UTC

greyfade wrote: post #11

If you think that's cool, look at Daeken's Magister: http://demoseen.com/windowpane/magister.png.html A PNG that's interpreted as HTML and loads itself as compressed JavaScript!

Trying to right click and save page as in Chrome crashes OS 10.7.4 for me. Pretty cool stuff.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#38

Post by tedunangst » Fri, Jul 06, 2012, 8:06 PM UTC

aidanns wrote: post #10

habosa wrote: post #2

Can someone explain what is going on here?

The file has been created in such a way that the web browser is ignoring the non-html parts of the document, while the image renderer is ignoring the parts that make up the html page. The first part probably isn't too hard, since most web browsers go to great lengths to render non-standard html in a sensible way, I'm not too sure about the second part. I'm guessing the jpeg spec has some variable length space in some…

jar files are just zip files, which put the header info at the end of the file, making it very easy to construct a jar/zip that's also got a different file header at the front. bad news for web apps which allow such files to be uploaded without inspecting them. it's not a terrible idea to always transcode all uploaded images/videos to prevent that.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#39

Post by lindenr » Fri, Jul 06, 2012, 8:10 PM UTC

WiseWeasel wrote: post #25

rescripting wrote: post #12

Perhaps I don't know enough about how this works, but couldn't you use this to inject runnable javascript in to a page? If this is possible it's pretty scary as it would allow you to upload a hidden payload in to an otherwise innocent looking image.

I was able to add javascript code in there and it executed properly, but the browser won't parse the jpg as html unless I give it a .html filename extension. I don't see how this could be easily exploitable.

Is it possible for the file extension to say one thing and the MIME type to say something else? So the file extension could be .jpg (reassuring the user that it is only an image) but the HTTP response says it is text/html?

I think a similar exploit was used recently with .svg images - they can contain javascript (being XML) which will be executed by the browser. Not sure about the details however.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#40

Post by temp1337 » Fri, Jul 06, 2012, 8:11 PM UTC

Can someone downvote me? I've put in some trolls, and apparently people are just silent about it. I think I tapped into some deep human insecurities, but I'm not really sure. I don't go to Hacker News much--I'd actually rather go to tmz most of the time if given the choice while the code is compiling.