Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A file that's both an acceptable HTML page and a JPEG (view source on it)

lcamtuf.coredump.cx

Post reply on HN
Print view View original

71–80 of 133 posts

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#71

Post by AndyKelley »

eric_arrr wrote: post #68
AndyKelley wrote: post #50

Earlier quoted context omitted.

Congratulations, the user is on your website, running your malicious javascript. Which is going to do what, exactly? It doesn't have access to any other site's cookies or information.

Yeah, what jack-r-abbit said: the point is you've got malicious script embedded in a page from somebody else's web site, so you have access to cookies and can inspect and/or manipulate the user's session arbitrarily.

Nope, you have an image embedded in somebody else's web site, the script never runs.

Also that's completely different than what you originally said.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#72

Post by mmahemoff »

I call such things "chameleon files"

JS and PHP is also possible http://tantek.pbworks.com/w/page/19402872/CassisProject

JS and HTML http://project.mahemoff.com/josh/ (also demonstrated by Tantek Çelik earlier on in a project that eentually led him to Cassis.)

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#73

Post by zbowling »

sold wrote: post #43

Reminds me of this story (JPEG and ZIP as one file): http://www.reddit.com/comments/arc79/reddit_i_got_the_best_p...

I used to use a similar trick with windows PE executables and ZIP files, basically making self extracting ZIP applications.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#74

Post by daeken »

mmahemoff wrote: post #72

I call such things "chameleon files" JS and PHP is also possible http://tantek.pbworks.com/w/page/19402872/CassisProject JS and HTML http://project.mahemoff.com/josh/ (also demonstrated by Tantek Çelik earlier on in a project that eentually led him to Cassis.)

The term most commonly used for such things is a 'polyglot': http://en.wikipedia.org/wiki/Polyglot_(computing)

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#75

Post by naugtur »

septerr wrote: post #70
naugtur wrote: post #48

Earlier quoted context omitted.

I posted my comment right before spotting your question... I Used a trick like that to be able to load my posterous posts with JSONP. http://zbyszek.posterous.com is loaded as content in http://naugtur.pl

Please explain~ (I can tell the magic is happening in fun.js and I could figure it out if I spend some time on it, but wouldn't mind the explanation handed to me on silver platter.) http://zbyszek.posterous.com - the theme for this, did you create it? It's neat. There are a pair of forward slashes at the beginning of the page though. In Chrome at least. http://naugtur.pl - Love the categorization and of course the an…

my posterous page starts with two slashes. They are discrete and they allow me to put JS code in a HTML comment. If you look at the source, you'll notice that when interpreted as JS it feeds a big array to window.posterousCB(). The rest is plain ond JSONP - define the global function first, and then load external cross-domain resource that runs the function with data.

As for animations - It's just a CSS transition definition and a single rule to rotate and scale an element. I created a hack that makes the CSS rule apply recursively. fun.js has some code that converts the simple html into a deeper structure.

I think someone else got the idea of _recursive CSS_ first, but it was used for drawing shapes as far as I remember.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#76

Post by shawndrost »

greyfade wrote: post #11

If you think that's cool, look at Daeken's Magister: http://demoseen.com/windowpane/magister.png.html A PNG that's interpreted as HTML and loads itself as compressed JavaScript!

WATCH IT. This file hard-froze my machine (osx/chrome) and I now have to rebuild my dev environment.

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#77

Post by naugtur »

grimtrigger wrote: post #65
naugtur wrote: post #44

There's a practical side to that trick. I have altered a posterous template to make my posterous a working JSONP response. http://zbyszek.posterous.com

How did you do it? ps. you have two uncommented slashes at the top of your tag

Yeah, the slashes are important. See my answer to the same question below in this topic. I don't want to repost more in case it's not welcome by the community :)

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#78

Post by mmahemoff »

daeken wrote: post #74
mmahemoff wrote: post #72

I call such things "chameleon files" JS and PHP is also possible http://tantek.pbworks.com/w/page/19402872/CassisProject JS and HTML http://project.mahemoff.com/josh/ (also demonstrated by Tantek Çelik earlier on in a project that eentually led him to Cassis.)

The term most commonly used for such things is a 'polyglot': http://en.wikipedia.org/wiki/Polyglot_(computing)

Didn't know that, thanks!

Re: A file that's both an acceptable HTML page and a JPEG (view source on it)

#79

Post by jack-r-abbit »

AndyKelley wrote: post #69
jack-r-abbit wrote: post #53

Earlier quoted context omitted.

I think (s?)he meant upload the image to someone else's site. The malicious code be running on that site... not your own. So then it does have access to that site's cookies.

nope, in this case the image will be interpreted as an image, not a script.

Right. I just took the example squirrel page, saved it, altered the comment section of the image to insert some javascript code alert('Hello') and opened it in my browser. It works but only if it is interpreted as html. So you'd need to be able to control it more.
Post reply on HN