Movatterモバイル変換


[0]ホーム

URL:


takesako, profile picture
Uploaded bytakesako
PPT, PDF4,716 views

HTML Binary Hacks & GIF89a Ployglot

http://conferences.yapcasia.org/ya2008/talk/1299

Embed presentation

Downloaded 45 times
HTML Binary Hacks - GIF89a Polyglot - Cybozu Labs, Inc. TAKESAKO <takesako@shibuya.pm.prg>
I’ll show you,  HTML 2.0 hacks.
1.0 HTML Browser Detection
HTML Quiz <img src=”1.gif” src=”2.gif”> (1) 1.gif  (2) 2.gif  (3) N/A Answers. Q1. What will you see?  (on your browser)
Q2. What’s this? <img /src  = ”1.gif” ”” src{\x00} = ”2.gif” ’ src{\x0c} = ”3.gif” src  = ”4.gif” /> (1) 1.gif  (2) 2.gif (3) 3.gif (4) 4.gif Answers. ->   ie ->   Safari ->   firefox ->   others

print<<EOF; <img /src \x00 =&quot;ie.gif&quot; /''src \x00 =&quot;firefox1_5.gif&quot; /''src=&quot;firefox2_0.gif&quot; /&quot;&quot;src=&quot;gecko_others.gif&quot; &quot;s \x00 rc=&quot;safari2.gif&quot; &quot;src=&quot;safari3.gif&quot; &quot;&quot;src=&quot;konqueror.gif&quot; src \x00 =&quot;w3m.gif&quot; src \x0c =&quot;opera.gif&quot; src=&quot;others.gif&quot; src=&quot;lynx.gif&quot; /> EOF
http://wafful.org Demo
 
It can detect “Konqueror”, “Safari2” !
No JavaScript & No CSS hacks
lynx
w3m
Mozilla/5.0 (PLAYSTATION 3; 1.00)    others.gif

1.0 The End
2.0 GIF89a Polyglot
Animation GIF image  Yappoc.gif
どう見ても Yappo です 本当にありがとう ございました(ry
Polyglot DEMO HTML/CSS & JS & Perl & GIF89a
JavaScript in GIF GIF89a( q /*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/ =1 );function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div>  */ // ;
HTML/CSS in GIF GIF89a(q/*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /* <body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1> <!-- ................................................ ................................................ ................................................ ................................................ --> <img src=?> <script src=# language=JavaScript></script> </div>  */// ;
Perl in GIF GIF89a(q /*....../ );sub GIF89a{print &quot;Hello Perl!&quot;} __END__ #*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div>  */// ;
Demo
 
 
Thank you

Recommended

PDF
SENI MADONSELA CV
DOC
Abdul Malik Omar cv
PDF
UP academic Record
PDF
Medhufushi Island Resort Experience Certificate
DOCX
TEBOGO MONYELA CV
PDF
CURRICULUM VITAE OF
DOCX
Diploma in civil engineering with 31 years experience both in project & main...
DOCX
Ma. Sarah Guevarra (Resume)QA (Autosaved) copy
PDF
Provisional Certificate
PDF
Trade Certificate (2)
PDF
Recommendation letter for Joseph Pirrone_Hakob_UMD Professor
PDF
Recommendation Letter Prof Miller
PDF
Letters of recomendation
PDF
Reference Letter Executive Chef
DOC
A CV of DR. Engr. Md. Mamunur Rashid
DOC
A.Nassir CV new
DOCX
unofficial transcript
DOC
Miss N P Dlamini CV (UpdatedCV2016) (1) (1)
PDF
Recommendation Letter 1
PDF
Degree and student copys
PDF
Transcripts of Grades in Masters- NTNU
PDF
Degree course complition letter
DOCX
BAFFOUR CV
PDF
MEng (Hons) Degree Certificate
PDF
letter of recommendation
DOCX
CURRICULUM VITAE Nozipho
DOCX
Yasin Ahmmed's Resume
PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
PDF
Security Automation using ZAP

More Related Content

PDF
SENI MADONSELA CV
DOC
Abdul Malik Omar cv
PDF
UP academic Record
PDF
Medhufushi Island Resort Experience Certificate
DOCX
TEBOGO MONYELA CV
PDF
CURRICULUM VITAE OF
DOCX
Diploma in civil engineering with 31 years experience both in project & main...
DOCX
Ma. Sarah Guevarra (Resume)QA (Autosaved) copy
SENI MADONSELA CV
Abdul Malik Omar cv
UP academic Record
Medhufushi Island Resort Experience Certificate
TEBOGO MONYELA CV
CURRICULUM VITAE OF
Diploma in civil engineering with 31 years experience both in project & main...
Ma. Sarah Guevarra (Resume)QA (Autosaved) copy

What's hot

PDF
Provisional Certificate
PDF
Trade Certificate (2)
PDF
Recommendation letter for Joseph Pirrone_Hakob_UMD Professor
PDF
Recommendation Letter Prof Miller
PDF
Letters of recomendation
PDF
Reference Letter Executive Chef
DOC
A CV of DR. Engr. Md. Mamunur Rashid
DOC
A.Nassir CV new
DOCX
unofficial transcript
DOC
Miss N P Dlamini CV (UpdatedCV2016) (1) (1)
PDF
Recommendation Letter 1
PDF
Degree and student copys
PDF
Transcripts of Grades in Masters- NTNU
PDF
Degree course complition letter
DOCX
BAFFOUR CV
PDF
MEng (Hons) Degree Certificate
PDF
letter of recommendation
DOCX
CURRICULUM VITAE Nozipho
DOCX
Yasin Ahmmed's Resume
Provisional Certificate
Trade Certificate (2)
Recommendation letter for Joseph Pirrone_Hakob_UMD Professor
Recommendation Letter Prof Miller
Letters of recomendation
Reference Letter Executive Chef
A CV of DR. Engr. Md. Mamunur Rashid
A.Nassir CV new
unofficial transcript
Miss N P Dlamini CV (UpdatedCV2016) (1) (1)
Recommendation Letter 1
Degree and student copys
Transcripts of Grades in Masters- NTNU
Degree course complition letter
BAFFOUR CV
MEng (Hons) Degree Certificate
letter of recommendation
CURRICULUM VITAE Nozipho
Yasin Ahmmed's Resume

Viewers also liked

PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
PDF
Security Automation using ZAP
PPTX
Application Security Vulnerabilities: OWASP Top 10 -2007
PPT
OAuth 2.0 & Security Considerations
PPTX
Application Security Risk Rating
PDF
HTML5 for Security Folks
Polyglot payloads in practice by avlidienbrunn at HackPra
Security Automation using ZAP
Application Security Vulnerabilities: OWASP Top 10 -2007
OAuth 2.0 & Security Considerations
Application Security Risk Rating
HTML5 for Security Folks

More from takesako

PPT
Shibuyajs Digest
PPT
HTML2.0 - digg - OSC2007-fall
PPT
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
PPTX
Node.js - JavaScript Thread Programming
PPTX
x86x64 SSE4.2 POPCNT
PPTX
Node.js - sleep sort algorithm
PPT
GIF89a Oldtype
PDF
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
PDF
SECCON CTF セキュリティ競技会コンテスト開催について
PPTX
再帰的 正規表現JSON Validator
PDF
Perl6 Regex Programming with Rakudo
PDF
Acme::MineChan LT demo
PDF
正規表現‐もう一つのバベルの塔‐木村浩一
PPT
Shibuyajs24 JavaScript.GIF x LiveConnect
PDF
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
PDF
Acme minechan
PDF
Devsumi2008 - YAPC::Asia 2008 Tokyo
PDF
Perl x86 JIT Programming
PPT
YAPC::Asia 2008 Closing Ceremony
Shibuyajs Digest
HTML2.0 - digg - OSC2007-fall
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
Node.js - JavaScript Thread Programming
x86x64 SSE4.2 POPCNT
Node.js - sleep sort algorithm
GIF89a Oldtype
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
SECCON CTF セキュリティ競技会コンテスト開催について
再帰的 正規表現JSON Validator
Perl6 Regex Programming with Rakudo
Acme::MineChan LT demo
正規表現‐もう一つのバベルの塔‐木村浩一
Shibuyajs24 JavaScript.GIF x LiveConnect
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
Acme minechan
Devsumi2008 - YAPC::Asia 2008 Tokyo
Perl x86 JIT Programming
YAPC::Asia 2008 Closing Ceremony

HTML Binary Hacks & GIF89a Ployglot

  • 1.
    HTML Binary Hacks- GIF89a Polyglot - Cybozu Labs, Inc. TAKESAKO <takesako@shibuya.pm.prg>
  • 2.
    I’ll show you, HTML 2.0 hacks.
  • 3.
  • 4.
    HTML Quiz <imgsrc=”1.gif” src=”2.gif”> (1) 1.gif (2) 2.gif (3) N/A Answers. Q1. What will you see? (on your browser)
  • 5.
    Q2. What’s this?<img /src = ”1.gif” ”” src{\x00} = ”2.gif” ’ src{\x0c} = ”3.gif” src = ”4.gif” /> (1) 1.gif (2) 2.gif (3) 3.gif (4) 4.gif Answers. -> ie -> Safari -> firefox -> others
  • 6.
  • 7.
    print<<EOF; <img /src\x00 =&quot;ie.gif&quot; /''src \x00 =&quot;firefox1_5.gif&quot; /''src=&quot;firefox2_0.gif&quot; /&quot;&quot;src=&quot;gecko_others.gif&quot; &quot;s \x00 rc=&quot;safari2.gif&quot; &quot;src=&quot;safari3.gif&quot; &quot;&quot;src=&quot;konqueror.gif&quot; src \x00 =&quot;w3m.gif&quot; src \x0c =&quot;opera.gif&quot; src=&quot;others.gif&quot; src=&quot;lynx.gif&quot; /> EOF
  • 8.
  • 9.
  • 10.
    It can detect“Konqueror”, “Safari2” !
  • 11.
    No JavaScript &No CSS hacks
  • 12.
  • 13.
  • 14.
    Mozilla/5.0 (PLAYSTATION 3;1.00)  others.gif
  • 15.
  • 16.
  • 17.
  • 18.
  • 19.
    どう見ても Yappo です本当にありがとう ございました(ry
  • 20.
    Polyglot DEMO HTML/CSS& JS & Perl & GIF89a
  • 21.
    JavaScript in GIFGIF89a( q /*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/ =1 );function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div> */ // ;
  • 22.
    HTML/CSS in GIFGIF89a(q/*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /* <body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1> <!-- ................................................ ................................................ ................................................ ................................................ --> <img src=?> <script src=# language=JavaScript></script> </div> */// ;
  • 23.
    Perl in GIFGIF89a(q /*....../ );sub GIF89a{print &quot;Hello Perl!&quot;} __END__ #*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div> */// ;
  • 24.
  • 25.
  • 26.
  • 27.

[8]ページ先頭

©2009-2025 Movatter.jp