29 ms·
This JPEG is also a webpage
- nashashmi 10y agoI didn't know what he was talking about until I tried this: data:text/html, <html><img src="http://lcamtuf.coredump.cx/squirrel/"></html> Put that in the url of the browser.
- d33 10y ago...how is that possible?
- d33 10y ago...this is probably a hint: 00000000 ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c |......JFIF.....,| 00000010 01 2c 00 00 ff fe 03 72 3c 68 74 6d 6c 3e 3c 62 |.,.....r<html><b| $ file index.html index.html: JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, comment: "<html><body><style>body { visibility: hidden; } .n { visibilit", baseline, precision 8, 1000x667, frames 3 I wonder what are the security implications of that.
- deathanatos 10y ago> I wonder what are the security implications of that. At least any terminal escape sequence can be executed if you run `file` on a JPEG, it seems, since this: curl -s 'http://www.imagemagick.org/image/fuzzy-magick.png' | convert - -set comment "$(printf 'asdf\x1b[1;31mTest?\x1b[0m hmm')" test2.jpg file test2.jpg Results in red text on my terminal for me. (It also results in file writing a 0xff 0xdb to the terminal, which the terminal turns into the unicode fallback character since it's not valid text…)
- michaelmior 10y agoI just get the following so it seems like my version of file has been patched to handle this case. test2.jpg: JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, comment: "asdf\033[1;31mTest?\033[0m hmm", baseline, precision 8, 320x85, frames 3
- throwanem 10y agoSame here with file(1) version 5.22 from the Debian jessie package repo. I'd be interested to know in which versions this kind of thing actually works.
- cesarb 10y agoMy first guess would be "the MacOS one", since from what I have heard, MacOS tends to have older (sometimes much older) versions of basic system utilities. I don't have a MacOS machine nearby to check, so this is just a guess.
- kalleboo 10y agoWell that and they have BSD rather than GNU versions
- jandrese 10y agoMight be a way to bypass malicious script detectors that see the JPEG header and stop trying to process the file. It will be stopped dead by metadata filters though. Stripping out the comment would be step #1 for those devices.
- ilkkao 10y agoI remember HTML parser was standarized in WHATWG. I guess it never gives up and keeps trying to find valid HTML tags
- Hannan 10y agoHe placed HTML inside a COM (comment) segment of the JPEG, which is perfectly legal. The ending of his HTML is "<!--" which starts an HTML comment, telling the browser to ignore all the data which follows (the image data). Since browsers are liberal in what they accept, they ignore the first 20ish bytes of the JPEG header, see the starting HTML tag, render the page, and ignore the fact that the comment never closes. http://dev.exiv2.org/projects/exiv2/wiki/The_Metadata_in_JPEG_files http://dev.exiv2.org/projects/exiv2/wiki/The_Metadata_in_JPE...
- pauldino 10y agoActually the browser isn't ignoring the first bytes of the JPEG before the <html> tag - it's there on the page, just hidden with CSS.
- daeken 10y agoI abused this concept to compress demo code in PNG files, with great success. http://demoseen.com/blog/2011-08-31_Superpacking_JS_Demos.html http://demoseen.com/blog/2011-08-31_Superpacking_JS_Demos.ht... This is, at present, the most efficient way to pack demos on the web; a few characters of uncompressed bootstrap code, then the rest is deflated.
- chriswarbo 10y agoSeems like some bits are missing on that page, e.g. I see nothing between "What is the bootstrap? Well, it's what turns our PNG into code and runs it. Here's the one I use:" and "The 4968 here is really the size of the decompressed data in bytes times 4"
- daeken 10y agoGood catch -- thank you! Imported this from an older blog and must've lost that code block somehow.
- alanh 10y agoLooks like some non-ascii characters didn't make the jump to hyperspeed, either, unless your friend really is named Nicolás Alvarez
- daeken 10y agoIt was looking fine on my end, but I realized I wasn't setting an encoding on the page. Should be UTF-8 now and not cause any more problems. Thanks for pointing it out!
- enraged_camel 10y agoThis link at the beginning seems to be not working: https://demoparty.mozillalabs.com/ https://demoparty.mozillalabs.com/
- fsiefken 10y agogreat hack, could you get javascript working inside a jpeg as well? Or obfuscate the javascript and decrypt in the browser for steganographic purposes?
- deleted 10y ago[deleted]
- StavrosK 10y agoNo, the JPEG header is at the start of the file, unlike the PNG which is at the bottom.
- fizzbatter 10y agoPardon my ignorance, but what does that matter? There's an important note in that the HTML is not at the true start of the JPEG file, it's slightly after. You can even view some of the JPEG format bytes if you view source of the HTML. So if the browser ignores some of the JPEG file, why not most of the PNG file? Perhaps you run the risk of some random byte screwing up the HTML though.. not sure.
- StavrosK 10y agoOh, you're right. I was thinking of the combined zip/png, and it's the zip file that has the header at the bottom, so my previous comment is completely wrong. The article seems to be adding the HTML in the EXIF data (thus making it a completely valid JPEG) and the browser tries to be very accommodating in what it accepts, thus ignoring the junk data (or what it thinks is junk data) at the start of the HTML file. Whether JS would work or not depends on how much the browser tries to recover from errors there. I would guess not much, but what would you gain from a combined JS/JPEG file anyway?
- ausjke 10y agoYou can use URI to embed images too, not sure how this is done though, why not just use URI?
- sp332 10y agoIt's not "embedded" like that, it's just an <img> tag that points to the same URL as the page.
- chriswarbo 10y agoData URIs are useful for embedding resources in a page (e.g. a single HTML file containing all of its own CSS, JS, images, etc.) This is different: it's a single file which can be parsed as either a HTML page or a JPEG. Hence, when a program expects a HTML page (like a browser loading a Web page), it will be parsed and displayed as a HTML page. When a program expects a JPEG file (like a browser loading the "src" of an "img" element) it will be parsed and displayed as a JPEG. The trick is to use each format's comment syntax to hide the other format. Not sure if the HTTP headers need to be set differently for each request or not.
- TazeTSchnitzel 10y agoI think it may only work if you omit a Content-Type header. Checking Firefox's Network tab, it looks like the server isn't serving one for that page.
- 286c8cb04bda 10y agoIt's sending the "wrong" one -- $ curl -I http://lcamtuf.coredump.cx/squirrel/ HTTP/1.1 200 OK Date: Thu, 11 Aug 2016 05:18:00 GMT Server: Apache Last-Modified: Mon, 19 Sep 2011 23:31:49 GMT Accept-Ranges: bytes Content-Length: 135938 Content-Type: text/html
- TazeTSchnitzel 10y agoOh. Huh. My bad. I guess browsers only forbid ignoring Content-Type for stuff like JS, then. For JPEG it's probably not a security concern.
- a1k0n 10y agoThat's a chipmunk, not a squirrel.
- tikhonj 10y agoI'm not an expert on squirrels, but that could be a ground squirrel[1] of some sort. Some varieties of ground squirrel look a lot like chipmunks. [1]: https://en.wikipedia.org/wiki/Ground_squirrel https://en.wikipedia.org/wiki/Ground_squirrel
- brlewis 10y agoA quick search for "striped ground squirrel" turned up only one variety, the thirteen-lined ground squirrel. The animal in the photo has stripes like a chipmunk.
- gmfawcett 10y agoLook for stripes on the face: without them, it's probably a squirrel. Both ground squirrels and chipmunks have body stripes, so the face is a better indicator. http://naturemappingfoundation.org/natmap/facts/chipmunk_vs_squirrel.html http://naturemappingfoundation.org/natmap/facts/chipmunk_vs_... http://www.differencebetween.info/difference-between-squirrel-and-chipmunk http://www.differencebetween.info/difference-between-squirre...
- deleted 10y ago[deleted]
- throwawayReply 10y agoI appreciate the technical trickery in this version, but has it not been possible to do this since at least 1996[1] by having the server serve different files based on the "Accept" http header? [1] https://www.w3.org/Protocols/HTTP/1.0/spec.html#Accept https://www.w3.org/Protocols/HTTP/1.0/spec.html#Accept
- united893 10y agoGreat, now construct a jpeg image that's valid HTML and a valid uncorrupted picture as well.
- aioprisan 10y agoThat's for the initial resource itself, not subsequent asset requests. For instance, an asset request is a separate request on a different domain, such as one for a customer service analytics tag, which is requested without any accept resource type request filter.
- throwawayReply 10y agoSo if the initial request comes with "Accept: text/html" then you serve a webpage. The request when linked as img comes as "Accept: /" and you serve an image. Perhaps caching or other schemes would break this, I'll try to knock up a PoC.
- aioprisan 10y agoSo in theory, can analytics platforms be compromised so that JPEG tracking pixels could turn into full-fledged sites interfering with the parent page at, say, a bank website? Firing off credentials in the background?
- yathern 10y agoNo, because if parsed as a JPEG, arbitrary code wont be run. If the jpeg was somehow parsed as JS, then possibly yes.
- aioprisan 10y agoThe image reference tag is for an image. As stated previously, if you look at the JPEG itself, it starts off with a JPEG comment, which embeds the entire html block, then starts a comment block for the remainder of the JPEG data. Browsers are very liberal in what they accept, so that initial 20-byte header is ignored, although you can see it if you inspect the page's elements.
- yathern 10y agoYes, I get that - but if a tracking pixel is downloaded and interpreted as a jpeg, then it will parse anything in the COM section as a comment, and not execute anything in it, unless there was some sort of vulnerability in the JPEG implementation
- deleted 10y ago[deleted]
- anonymfus 10y agoIf these tracking pixels are in iframe elements instead of img elements.
- yathern 10y agoIf they were iframe elements, they'd still be sandboxed from the parent page, and unable to phone-home with information, right?
- danbruc 10y agoA testament to one of the worst decisions in computing history - not to fail displaying a web page with an error message in case it is not a valid HTML document.
- rimantas 10y agoOr one of the best. Switch wen browsers to strict processong and you will hardly find working web page.
- ygjb 10y agoYeah, imagine if processors gave best effort to processing binaries... what could possibly go wrong :/ The decision to allow this was made early and the liberal accept/strict transmit paradigm has in general made the web a mess. On the plus side, the consistent failure of browser vendors to apply strict controls to input means that as an application security person I will probably never be out of work :D Even though this pattern of behavior is starting to change, legacy support means that I will still be dealing with these issues well into my retirement!
- dpark 10y ago> as an application security person I will probably never be out of work How many security flaws are the result of malformed HTML?
- Chernobog 10y agoMalformed HTML may escape sanitization on input in a vulnerable web app, and still render on the victim's browser because their browser wants to be helpful. (Yes, the output should have been escaped, but that is sadly not always the case)
- dpark 10y agoI don't see how this has anything to do with malformed HTML or lenient rendering rules. In the scenario you're describing, well-formed but malicious HTML could also escape sanitization.
- tomw1808 10y ago> Pretty radical, eh? Send money to: lcamtuf@coredump.cx How to send money to your email address? Not that I would send you some, but I wondered how you want to have that money received?
- ninjakeyboard 10y agoemail money transfer should work fine aka Interac E-Transfer. see http://interac.ca/en/interac-e-transfer-consumer.html http://interac.ca/en/interac-e-transfer-consumer.html
- srhngpr 10y agoOnly in Canada :)
- deleted 10y ago[deleted]
- tener 10y agoPayPal?
- nerevarthelame 10y agoHe\she isn't actually expecting payment, just as they don't really think that the trick is "pretty radical." It's just a mildly amusing way of providing contact information.
- JoblessWonder 10y agoIt is pretty radical in the 80's-90's sense of the word.[0] [0] http://img03.deviantart.net/ebd4/i/2015/166/9/6/radical_dude_by_olita426-d8xh8qk.jpg http://img03.deviantart.net/ebd4/i/2015/166/9/6/radical_dude...
- STRiDEX 10y agoI assume paypal when i see an email.
- kessiler 10y agonice trick!
- kbenson 10y agoPrior discussion, years ago, many comments: https://news.ycombinator.com/item?id=4209052 https://news.ycombinator.com/item?id=4209052
- xyclos 10y agowhich begs the question: where are all the "essential squirrel facts" that were promised?
- kbenson 10y agoI'll admit, I had the same thought. :)
- mistersquid 10y agoMaybe a product manager realized it didn't make sense to provide "essential squirrel facts" to a page featuring the image of a chipmunk. :-)
- ferrari8608 10y agoThe fact they didn't want us to know
- f- 10y agoAuthor here. Rookie mistake! It's actually a golden-mantled ground squirrel. https://en.wikipedia.org/wiki/Golden-mantled_ground_squirrel https://en.wikipedia.org/wiki/Golden-mantled_ground_squirrel A chipmunk would have a stripe going across the eye. (Today, you learned your first squirrel fact!)
- mistersquid 10y agoI did learn something new, not just about squirrels but about chipmunks, too. Thank you. And here I was impressed merely by the delivery of image data in the HTML stream. Little did I realize your page is practically an Encyclopedia Rodentia. Kudos and hats off.
- imurray 10y agoRight-clicking on the image and selecting "View Image" (Firefox), or "Open image in a new tab" (Chromium), gives the webpage, not the image. I can see why that happens: the menu items just open a URL and don't force it to be an image. However, it was a bit disorienting.
- coding123 10y agoI did this too, repeatedly, until I was smiling a very big smile.
- deleted 10y ago[deleted]
- amavisca 10y agoThis site uses the xmp tag (deprecated in HTML 3.2, removed in HTML5) which I found interesting and had never seen! https://developer.mozilla.org/en-US/docs/Web/HTML/Element/xmp https://developer.mozilla.org/en-US/docs/Web/HTML/Element/xm... It's similar to the pre tag but doesn't require the escaping. I guess you just have to make sure you don't have a closing xmp tag :)
- krapp 10y ago<xmp> is great when you absolutely, positively, do not want any entities rendered under any circumstances. It's unfortunate that it's being deprecated, since it has its uses.
- gioele 10y ago> <xmp> is great when you absolutely, positively, do not want any entities rendered under any circumstances. It's unfortunate that it's being deprecated, since it has its uses. <![CDATA[ here &entities; or <angle|<brackets>> will not interpreted ]]> There is no need for special-casing xmp, when SGML and XML already define CDATA escapes.
- gsnedders 10y agoRemoved? "User agents must treat xmp elements in a manner equivalent to pre elements in terms of semantics and for purposes of rendering. (The parser has special behaviour for this element though.)" — https://html.spec.whatwg.org/multipage/obsolete.html#requirements-for-implementations https://html.spec.whatwg.org/multipage/obsolete.html#require...
- amavisca 10y agoI was just going off what the MDN page said about it being removed in the HTML5 standard. It looks like WHATWG just has a "living standard" and W3C still uses the versioning, so it's probably removed from W3C standards. I'm not too familiar with the reality of these standards.
- kingkool68 10y ago
- blahpro 10y agoI like this bit: <img src="#" [...]>
- loudmax 10y agoYou can see this in action for yourself on a unix cli: $ curl -o squirrel.html http://lcamtuf.coredump.cx/squirrel/ $ file squirrel.html squirrel.html: JPEG image data, JFIF standard 1.01, comment: "<html><body><style>body { visibility: hidden; } .n { visibilit" Open the file in a browser and read the page. Then: $ mv squirrel.html squirrel.jpg Open the renamed file in a browser and only the image appears. I'm not sure what the security implications are. I'm not creative or devious enough to think of anything offhand, but a lot of attack vectors start off with this sort of misdirection.
- lisper 10y ago> I'm not sure what the security implications are. You can use this technique to phish signatures. Send someone a document that reads "X" in format A and "Y" in format B. The victim signs file.A thinking they are endorsing X but you can plausibly claim that they signed file.B (because it's the same file) and hence endorsed Y. This is why digital signature standards need to include meta-data, e.g.: https://github.com/Spark-Innovations/SC4/blob/master/doc/file_formats.md https://github.com/Spark-Innovations/SC4/blob/master/doc/fil... Scroll down to "bundle files"
- mseebach 10y ago> but you can plausibly claim And anyone else can plausibly claim that you carefully forged a file to get a victim to sign it -- the signature will be of the whole file, not just a single view of it. But that said, you shouldn't sign binary files unless you have a reasonable understanding of what is in it (or trust the party presenting it to you).
- lisper 10y ago> And anyone else can plausibly claim that you carefully forged a file to get a victim to sign it Yes, of course, but by the time someone realizes this the damage may already have been done. > you shouldn't sign binary files There are a lot of things that people shouldn't do that they do nonetheless.
- 10y ago
- gkya 10y agoC'mon, don't be so stingy, give him a Ben at least :) _____________________________________________________________________ | | | =================================================================== | | |%/^\\%&%&%&%&%&%&%&%&{ Federal Reserve Note }%&%&%&%&%&%&%&%&//^\%| | | |/inn\)===============------------------------===============(/inn\| | | |\|UU/ { UNITED STATES OF AMERICA } \|UU/| | | |&\-/ ~~~~~~~~ ~~~~~~~~~~=====~~~~~~~~~~~ P8188928246 \-/&| | | |%//) ~~~_~~~~~ // ___ \\ (\\%| | | |&(/ 13 /_\ // /_ _\ \\ ~~~~~~~~ 13 \)&| | | |%\\ // \\ :| |/ ~ \| |: 3.21 /| /\ /\ //%| | | |&\\\ ((iR$)> }:P ebp || |"- -"| || || |||| |||| ///&| | | |%\\)) \\_// sge || (|e,e|? || || |||| |||| ((//%| | | |&))/ \_/ :| `._^_,' |: || |||| |||| \((&| | | |%//) \\ \\=// // || |||| |||| (\\%| | | |&// R265402524K \\U/_/ // series || \/ \/ \\&| | | |%/> 13 _\\___//_ 1932 13 <\%| | | |&/^\ Treasurer ______{Franklin}________ Secretary /^\&| | | |/inn\ ))--------------------(( /inn\| | | |)|UU(================/ ONE HUNDERED DOLLARS \================)|UU(| | | |{===}%&%&%&%&%&%&%&%&%a%a%a%a%a%a%a%a%a%a%a%a%&%&%&%&%&%&%&%&{===}| | | ==================================================================== | |______________________________________________________________________| source: http://chris.com/ascii/index.php?art=objects/money http://chris.com/ascii/index.php?art=objects/money
- hardmath123 10y agoSome PoC||GTFO PDFs are also valid in other formats—"polyglots". They usually do PDF+HTML+ZIP, though sometimes they get (even more) creative. https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/
- Dylan16807 10y agoKeep in mind that combining most normal formats with most archive formats is trivial, because normal formats start at the beginning, and archive formats have a table of contents at the end. Concatenate both files and you're done. Combining with PDF is also on the easy end of things, because the PDF header just has to be somewhere vaguely near the start.
- david_ar 10y agohttp://uds-datalab.github.io/PDBF/ http://uds-datalab.github.io/PDBF/ also does this
- metrognome 10y agoYou could do the same thing with a .wav file, embedding the HTML after the data sub-chunk. Adobe Audition uses this method to embed application-specific metadata for the file (marker and sub-marker locations, for example).
- jschwartzi 10y agoWAV is actually a specialization of an old container format called RIFF. RIFF allows for extensibility by allowing the embedding of arbitrary data. So this is technically a legitimate use of RIFF because it's designed to support multi-purpose contents, not just PCM data.
- voltagex_ 10y agoAha! This is how Beatport were putting title/artist data in WAVs. I'm not sure why they did that instead of just sending FLACs, though...
- slice-beans 10y agoInterestingly, this page is intercepted by my router which then just sends me a redirect to one of its settings pages. Odd.
- alanh 10y agoWell now, that is interesting… deep packet inspection? or just a truly insane bug? What router is it?
- slice-beans 10y agoHere's the request and response from router: http://pastebin.com/e7rxLsGJ http://pastebin.com/e7rxLsGJ The router itself is a BT Internet (UK) branded one. Not sure of the exact model but I'll try to find out...
- fosk 10y agoBesides the model number, can you also tell us the firmware version?
- slice-beans 10y agoBT Home Hub 5 (Type A) Software version 4.7.5.1.83.8.204.1.11 But, false alarm anyway, nothing interesting is happening. The firmware had updated and reset parental control settings on the router. The domain is on some blacklist apparently so it was redirecting to a page to finalise parental control preferences. Sorry it wasn't any more interesting than that. Edit: the reason it took me a while to figure this out was that the settings page it was redirecting to was nothing to do with parental controls!
- rad_gruchalski 10y agoThe HomeHub 5 is a Thomson (Technicolor) router, if I remember correctly.
- 10y ago
- chrischen 10y agoThis would be a unique way to make downloading images harder.
- MikeTV 10y agoJust what I was thinking. It doesn't actually prevent the user from downloading the image, just makes them think that they failed to download the image (since it saves with a .htm extension). The HTML file could be one that admonishes the user for attempting to scrape the file, all the while the file they wanted is sitting right there. A modern day Purloined Letter.
- goda90 10y agoI just right clicked on the image and saved it in Firefox and it gave me a .jpg. I was still able to change it into a working .html file by renaming it. I imagine some systems for downloading would get it messed up, but Firefox at least treats it as a JPEG when you're interacting with the image tag.
- EGreg 10y agoCan someone explain in simple English how this works?
- alanh 10y ago1. HTML is very forgiving. HTML also provides a comment mechanism <!-- --> between which anything will be ignored from a browser perspective. 2. JPEG also allows for comments and other embedded metadata which won't show up in the displayed image. 3. Start the file with a JPEG header and metadata section, then switch between HTML and JPEG using the comment functionality mentioned above Essentially! "But wait, why is it shown as an image in one context and as a web page in another?" The answer is in the question: Context. If you expect a JPEG you will get a JPEG, and same for HTML.
- quantumhobbit 10y agoJPEG images allow comments. The html is stored in the comment. Browsers assume they are reading an HTML file and loads the comment. When the browser thinks it is reading an image, like in an <img> tag, it reads the image ignoring the comment.
- tarball 10y agoHere is a similar experimental project I made, between image and web page : http://raphaelbastide.com/guropoli/ http://raphaelbastide.com/guropoli/
- tambourine_man 10y agoPreviously, on HN: https://news.ycombinator.com/item?id=4209052 https://news.ycombinator.com/item?id=4209052
- rcthompson 10y agoI wonder if browsers are smart enough to only download the file once for the html and then cache it for the embedded image.
- kalleboo 10y agoIt looks like Safari is at least, and it even de-duplicates it in the Web Inspector so it only lists a single resource (which gets listed as "type: image"
- thomasfoster96 10y agoYep, Safari doing the same for me. Although I'm seeing it as an image with type "text/html", which is odd.
- webXL 10y agoDO NOT run Chrome's Timeline dev tool on this when reloading. Crashed a couple tabs. Good edge case for browser tests!
- voltagex_ 10y agoWorks for me, 50.0.2661.94 on Windows 7 x64.
- tannerc 10y agoCurious, how do search engine crawlers interpret this? Would it be the same as a browser, i.e. the bot would treat the requested img url respectfully?
- ComodoHacker 10y ago>No server-side hacks involved I doubt this. In request with Accept:"image/png,image/;q=0.8,/*;q=0.5" server souldn't respond with something with Content-Type:"text/html"
- eriknstr 10y agomkdir -p ~/tmp/squirrel cd ~/tmp/squirrel wget -O index.htm http://lcamtuf.coredump.cx/squirrel/ http://lcamtuf.coredump.cx/squirrel/ firefox index.htm Alternately, using an actual webserver instead of opening a file:// python3 -m http.server & firefox http://127.0.0.1:8000/ http://127.0.0.1:8000/ Also works. Note that the actual img tag has src="#" so when you are looking at the file opened locally, the image is also from local disk, not from his server, so it's legit. However, the fact that it needs to be identified as a HTML file by the server implies to me that the idea others had ITT of abusing image hosting sites using this trick probably won't work.
- mistercow 10y agoThat's kind of nitpicky.
- grimmdude 10y agoThis is cool. Though the 133kb download size for the html isn't great.
- pritianka 10y agoReminds me of Pied Piper for some reason :-)
- pschastain 10y agoNo explanation of what's going on?
- tgarma1234 10y agoWell this will certainly appeal to Steganography enthusiasts and perverts who have clumsily been loafing around .onion sites for years and who now finally have a way to share content in the clear. And of course the NSA, FBI and CIA are suddenly stuck trying to figure out why this goofy squirrel is so popular in Yemen. mv squirrel.html squirrel.jpg sudo apt-get install steghide steghide embed -cf squirrel.jpg -ef secret.txt mv squirrel.jpg squirrel.html And voila...
- caub 10y agoanchors are not interpreted as html
- soheil 10y agoCan you make it play a video too?
- hughbetcha 10y agoCette jpg est pas une pipe.
- koytch 10y agoAlong similar lines: https://www.alchemistowl.org/pocorgtfo/ https://www.alchemistowl.org/pocorgtfo/ Some of the PDFs also happen to be valid images, audio files, zip archives, etc.
- pix64 10y agoNeat idea. Here is a BMP I just threw together that is also a webpage. https://mega.nz/#!49MnjKCJ!7HShAESfmM2R450x4z-zLmtCDotOhsLzemQHcYuTINY https://mega.nz/#!49MnjKCJ!7HShAESfmM2R450x4z-zLmtCDotOhsLze...
- pdkl95 10y agohttps://media.ccc.de/v/31c3_-_5930_-_en_-_saal_6_-_201412291400_-_funky_file_formats_-_ange_albertini https://media.ccc.de/v/31c3_-_5930_-_en_-_saal_6_-_201412291... Funky File Formats
- OR13 10y agohttps://ipfs.pics/QmRcm8yiCYmQ1jDxhUVtsjvps4XjtjSTziVSdQsszuiRfw https://ipfs.pics/QmRcm8yiCYmQ1jDxhUVtsjvps4XjtjSTziVSdQsszu...
- OR13 10y agohttps://ipfs.pics/QmRcm8yiCYmQ1jDxhUVtsjvps4XjtjSTziVSdQsszuiRfw https://ipfs.pics/QmRcm8yiCYmQ1jDxhUVtsjvps4XjtjSTziVSdQsszu...
- haddr 10y agoCan I upload such image for instance to facebook and intent to run it as html (with some JS inside)?
- nickfrostatx 10y agoThey usually set the content type to that of an image so the browser won't execute the JS. They've messed this up in the past, see this legendary bug bounty report [1] 1. https://whitton.io/articles/xss-on-facebook-via-png-content-types/ https://whitton.io/articles/xss-on-facebook-via-png-content-...
- voltagex_ 10y agoI'm a big fan of Ange Albertini's work with this kind of stuff - https://github.com/corkami/ https://github.com/corkami/ There's a talk called "Funky File Formats" but there's (fittingly) multiple versions of it so you're best off searching for it.
- peterburkimsher 10y agoNice trick! I'm interested in encoding other kinds of data in images in order to share apps/music/etc between mobile devices. Unfortunately, your HTML gets lost I try to save the picture on my phone. iPhone > Safari > Save to Camera Roll Copy off the picture; it's been re-encoded and has no JPG comment field. Any solutions to this are welcome! The re-encoding makes patterns impossible to decode as well (they degrade after being shared a couple of times). See Cemetech's jsTified emulator for an example of a ROM file as a JPG - he uses B/W and it still requires the file to be synced from a computer, not saved from the browser.
- akash0x53 10y agoShould i expect the same behavior in Facebook? I didn't get image though.
- antmldr 10y agoSaumil Shah released a framework for producing images using this technique to deploy browser exploits (but could potentially be used for anything). Worth a look if you'd like to make your own! http://stegosploit.info/ http://stegosploit.info/
- pjf 10y agohttps://www.w3.org/Bugs/Public/show_bug.cgi?id=29771 https://www.w3.org/Bugs/Public/show_bug.cgi?id=29771
- SmellyGeekBoy 10y agoI'm surprised nobody in this thread has mentioned PICO-8, a "virtual console" which compresses its "cartridges" in the form of a PNG file. When viewed in a browser or on a computer the file is displayed as a neat stylised image of a cartridge with a description, box art etc but when opened in the PICO-8 executable reveals all of the game code, art and music/sound assets in fully uncompressed editable form. The cartridges can be shared freely on sites that leave the original file intact without re-compressing. Nifty! http://www.lexaloffle.com/pico-8.php http://www.lexaloffle.com/pico-8.php
- govindpatel 10y agowell I just thought that it is some bug in html img tag. But still nice finding