5 ms·

Imagejs – A small tool to hide JavaScript inside a valid image file

• ins0 12y ago
  this technique is old - but good to remind someone that this is possible
• toblender 12y ago
  Very cool. However I wonder if someone will try this on sharing sites like facebook to see if it works.
  • ins0 12y ago
    as in the destriction explained, this only works when the image is loaded inside a javascript src tag
  • dwild 12y ago
    An img tag won't execute a script, it need to be the src of the script tag. I'm curious to see the really specific case where this is needed. What actually will scan to make sure it's an image but then set it as a src on a script tag?
    • ins0 12y ago
      some javascript files are merged over params like ?js=foo.js_bar.js but indeed the attack surface is very small
      • dwild 12y ago
        Ok you would first need to upload the gif on the website and then do that. Yeah interesting, really small attack surface but still one that we should think about.
    • Kudos 12y ago
      It's for circumventing Same-origin where you can get a url into a script tag on a page, but it won't execute unless it's from the same origin. https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
    • drinchev 12y ago
      I'm also curious. First things that pop up in my mind : 1. Hiding javascript one level more ( slightly harder to find what is going on than uglified JS ) 2. Avoiding some script blocking scripts ( imagine ad-blocker that is not configured for such javascript option ) 3. Saving traffic by putting javascript in the same request as an image resource that you are actually using.