61–70 of 133 posts
Reminds me of this story (JPEG and ZIP as one file): http://www.reddit.com/comments/arc79/reddit_i_got_the_best_p...
That just looks like the "append rar to a jpg" trick that /i/nsurgents have been using to pass files around on the *chans for ages ( see: dangerous kitten http://encyclopediadramatica.se/Dangerous_kitten )
Earlier quoted context omitted.
Holy Fuck.... that looked really cool as it brought my whole system to a dead stop. Took forever to recover enough to close the tab. :/
Really? I see no slowdown whatsoever. What are you running?
You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…
Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.
There's a practical side to that trick. I have altered a posterous template to make my posterous a working JSONP response. http://zbyszek.posterous.com
ps. you have two uncommented slashes at the top of your tag
You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…
You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…
You can also use this trick to launch cross-site script attacks against sites that allow you to upload images. Step 1: upload the "image" to the site. Let the site do whatever it does to ensure it has received a valid image. Nine validators out of ten will happily accept the file; the case that is likeliest to shoot you down is if the site modifies the image by cropping, resizing, or watermarking it. Step 2: point yo…
Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.
Earlier quoted context omitted.
Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.
I think (s?)he meant upload the image to someone else's site. The malicious code be running on that site... not your own. So then it does have access to that site's cookies.
Any practical use for this or just for fun?
I posted my comment right before spotting your question... I Used a trick like that to be able to load my posterous posts with JSONP. http://zbyszek.posterous.com is loaded as content in http://naugtur.pl
http://zbyszek.posterous.com - the theme for this, did you create it? It's neat. There are a pair of forward slashes at the beginning of the page though. In Chrome at least.
http://naugtur.pl - Love the categorization and of course the animation. What are you using to do the animation?
Thanks~