5 ms·
Show HN: A cookie stealer disguised as a GIF image
- codegladiator 8y agoOne of the oldest trick in blackhat ?
- atum47 8y agoit's a old project. I've been upload all the tools I ever made to git.
- Arnt 8y agoIf you expect anyone to evaluate your github stuff and care about the result, then I suggest adjusting your commit dates to reflect reality. https://stackoverflow.com/q/454734/fnord https://stackoverflow.com/q/454734/fnord explains how to.
- atum47 8y agoWell, it's done. I removed the repo. I spent my entire day yesterday arguing with people if this works or don't. I found some links proving my point, but I'm not a expert on the matter, so I give up. Here's the link about the browser sending cookies with request to external image: https://bugzilla.mozilla.org/show_bug.cgi?id=375238 https://bugzilla.mozilla.org/show_bug.cgi?id=375238 Heres the link about the video using a similar technique: https://youtu.be/KaEj_qZgiKY?t=160 https://youtu.be/KaEj_qZgiKY?t=160
- atum47 8y agoThe code is old, I'm not posting new things, I'm posting things I've been doing since I started college. It's been recent since I decided to put all my codes and experiments on git hub. This one in particular caused more headache then anything, so I took it down.
- jsjohnst 8y agoHas anyone looked at the code for this? It’s a joke (whether intended as one or not), it doesn’t really “steal” anything.
- atum47 8y agoThe image.php file creates and writes a json dump of the request made (where the cookie is). The stealing part is when you inject the code on random web site.
- jsjohnst 8y agoExcept a browser doesn’t send cookies from one random domain to an “image” hosted on another domain, hence no “theft”. Cross origin cookie rules have been the same for eons.
- atum47 8y agoWell, it worked for me. I was using Moodle in class and the teacher opened a chat so we can all discuss some project; I realized the chat accepts html and wrote this script. I hosted it on my website and it worked.
- jsjohnst 8y agoI call bullshit unless this class was 20 years ago.
- atum47 8y agoDude, look at this video: https://youtu.be/KaEj_qZgiKY?t=181 https://youtu.be/KaEj_qZgiKY?t=181
- laomona 8y agoThe cookies from the image domain are the ones that will be sent, not the ones from the domain that the image is displayed on. Hence, doesn't work unless you can host your php on the targeted domain
- atum47 8y agoI have decided to delete this repo. I'm not an expert on security and how each browser deals with session cookies. Sorry about any inconvenience.