3 ms·
I think (s?)he meant upload the image to someone else's site. The malicious code be running on that site... not your own. So then it does have access to that si
by jack-r-abbit 14y ago
I think (s?)he meant upload the image to someone else's site. The malicious code be running on that site... not your own. So then it does have access to that site's cookies.
- AndyKelley 14y agonope, in this case the image will be interpreted as an image, not a script.
- jack-r-abbit 14y agoRight. I just took the example squirrel page, saved it, altered the comment section of the image to insert some javascript code alert('Hello') and opened it in my browser. It works but only if it is interpreted as html. So you'd need to be able to control it more.