3 ms·
This hack works by disabling the real cursor (using a custom CSS cursor image set to a transparent png), then moving around a fake cursor image using JS. See b
by jamesfisher 10y ago
This hack works by disabling the real cursor (using a custom CSS cursor image set to a transparent png), then moving around a fake cursor image using JS.
See by comparison this hack I made a few months ago [1], which uses a dynamic CSS cursor image (drawn in JS). The interesting thing it shows is that CSS cursors can escape the viewport, leading to possible security issues.
[1]: https://jameshfisher.github.io/cursory-hack/ https://jameshfisher.github.io/cursory-hack/
- nsgi 10y agoNice hack. It's not obvious whether it still works now that GitHub Pages uses HTTPS, though the fact that clicking on the page triggers the same action as clicking the page icon/padlock suggests it does.
- zeta0134 10y agoI'm on a Linux machine and figured out the trick fairly quickly: clicking the green padlock does not perform the same action. That's part of the hack too, the interface that pops up is styled like the Windows dialog and isn't interactive. (Clicking on it simply dismisses it.) It's quite convincing otherwise, and that's very frightening. :)
- chias 10y agoCool idea! This seems to work oddly for high-DPI displays: the cursor is microscopic and doesn't seem to escape the viewport.
- d2p 10y agoSame here on a non-hdpi screen (Dell Chromebook 11). The fake padlock appears inside the body and it's quite clearly not part of the browser. Not sure if something changed since it was built or maybe it only works in certain browsers, but certainly doesn't seem like an exploitable issue here.
- trishtrish691 10y agoContact thewhitehathacker2012@gmail.com for all you hacking jobs and if you suspect any unfaithfulness from your spouse or girlfriend , he is the best you can get just tell him you saw a post from Trishia or else he might not reply +15134003546