3 ms·
I'm not sure I understand this correctly: > This is a line of CSS, specifying that the ‘menu’ style should fetch a background image from the given URL. On load
by croemer 2y ago
I'm not sure I understand this correctly:
> This is a line of CSS, specifying that the ‘menu’ style should fetch a background image from the given URL. On loading the page, the web browser will attempt to fetch the specified .gif file from the w2img.com server.
> Note: Disclosing just the domain in referrers is a relatively recent browser change, and indeed attackers using older browsers were sending us full shell URLs.
In particular re "attackers using older browsers": haven't the (original) attackers taken over the _server_ that's serving the CSS and the browser belongs to unsuspecting _users_ of the pwned server? Isn't it wrong to say the attackers use the browsers then, as the browser is used by a victim?
Under which circumstances would _attackers_ be using a browser? I can't make sense of this.
- TazeTSchnitzel 2y agoA webshell is a page (typically a .php file) uploaded to a site by an attacker after a compromise (e.g. an RCE), which is then used by an attacker through their browser to perform further actions on the compromised webserver. These premade webshell files however have been made by other attackers and come pre-compromised with a backdoor. In this case the CSS in the webshell makes the attacker's browser snitch the webshell's location to a domain controlled by the author of the webshell.
- croemer 2y agoThanks that makes sense, not sure how I could miss that.