Форумы Сокрытие xss в картинке

Discussion in 'Уязвимости CMS/форумов' started by W.W., 22 Nov 2005.

  1. W.W.

    W.W. New Member

    Joined:
    21 Nov 2005
    Messages:
    9
    Likes Received:
    1
    Reputations:
    0
    *удалено*

    *удалено*
     
    #1 W.W., 22 Nov 2005
    Last edited: 10 Sep 2014
  2. avrely

    avrely New Member

    Joined:
    2 Nov 2005
    Messages:
    17
    Likes Received:
    0
    Reputations:
    0
    вписывай скрипт в заголовки exif

    и человек должен пройти по ссылке твоей аватары чтобы куки отослались.
     
  3. W.W.

    W.W. New Member

    Joined:
    21 Nov 2005
    Messages:
    9
    Likes Received:
    1
    Reputations:
    0
    *удалено*
     
    #3 W.W., 22 Nov 2005
    Last edited: 10 Sep 2014
  4. avrely

    avrely New Member

    Joined:
    2 Nov 2005
    Messages:
    17
    Likes Received:
    0
    Reputations:
    0
    после скрипта поставь редирект

    <meta http-equiv=refresh content=0;URL=тут_адресс_картинки>
     
  5. W.W.

    W.W. New Member

    Joined:
    21 Nov 2005
    Messages:
    9
    Likes Received:
    1
    Reputations:
    0
    *удалено*
     
    #5 W.W., 22 Nov 2005
    Last edited: 10 Sep 2014
  6. GreenBear

    GreenBear наркоман с медалью

    Joined:
    7 May 2005
    Messages:
    2,547
    Likes Received:
    1,398
    Reputations:
    612
    а не проще ли
    <script>...</script>
    <img src=image.gif>
    использовать?
     
  7. W.W.

    W.W. New Member

    Joined:
    21 Nov 2005
    Messages:
    9
    Likes Received:
    1
    Reputations:
    0
    *удалено*
     
    #7 W.W., 22 Nov 2005
    Last edited: 10 Sep 2014
  8. GreenBear

    GreenBear наркоман с медалью

    Joined:
    7 May 2005
    Messages:
    2,547
    Likes Received:
    1,398
    Reputations:
    612
    используй *.jpg
    эфект тотже, но вроде не кажет ничего лишнего.
     
  9. pch

    pch Elder - Старейшина

    Joined:
    22 Oct 2005
    Messages:
    34
    Likes Received:
    41
    Reputations:
    15
    GIF98 можно спрятать через <style>:
    Code:
    <style>
               *{display:none}
                IMG {display:block}
    </style>
    
    У меня это проходило.
    ЗЫ Может быть не display, a visible - точно не помню
     
  10. W.W.

    W.W. New Member

    Joined:
    21 Nov 2005
    Messages:
    9
    Likes Received:
    1
    Reputations:
    0
    *удалено*
     
    #10 W.W., 23 Nov 2005
    Last edited: 10 Sep 2014
  11. W.W.

    W.W. New Member

    Joined:
    21 Nov 2005
    Messages:
    9
    Likes Received:
    1
    Reputations:
    0
    *удалено*
     
    #11 W.W., 23 Nov 2005
    Last edited: 10 Sep 2014