SlideShare a Scribd company logo
1 of 27
HTML Binary Hacks - GIF89a Polyglot - Cybozu Labs, Inc. TAKESAKO <takesako@shibuya.pm.prg>
I’ll show you,  HTML 2.0 hacks.
1.0 HTML Browser Detection
HTML Quiz <img src=”1.gif” src=”2.gif”> (1) 1.gif  (2) 2.gif  (3) N/A Answers. Q1. What will you see?  (on your browser)
Q2. What’s this? <img /src  = ”1.gif” ”” src{00} = ”2.gif” ’ src{0c} = ”3.gif” src  = ”4.gif” /> (1) 1.gif  (2) 2.gif (3) 3.gif (4) 4.gif Answers. ->   ie ->   Safari ->   firefox ->   others

print<<EOF; <img /src 00 =&quot;ie.gif&quot; /''src 00 =&quot;firefox1_5.gif&quot; /''src=&quot;firefox2_0.gif&quot; /&quot;&quot;src=&quot;gecko_others.gif&quot; &quot;s 00 rc=&quot;safari2.gif&quot; &quot;src=&quot;safari3.gif&quot; &quot;&quot;src=&quot;konqueror.gif&quot; src 00 =&quot;w3m.gif&quot; src 0c =&quot;opera.gif&quot; src=&quot;others.gif&quot; src=&quot;lynx.gif&quot; /> EOF
http://wafful.org Demo
 
It can detect “Konqueror”, “Safari2” !
No JavaScript & No CSS hacks
lynx
w3m
Mozilla/5.0 (PLAYSTATION 3; 1.00)    others.gif

1.0 The End
2.0 GIF89a Polyglot
Animation GIF image  Yappoc.gif
どう見ても Yappo です 本当にありがとう ございました(ry
Polyglot DEMO HTML/CSS & JS & Perl & GIF89a
JavaScript in GIF GIF89a( q /*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/ =1 );function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div>  */ // ;
HTML/CSS in GIF GIF89a(q/*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /* <body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1> <!-- ................................................ ................................................ ................................................ ................................................ --> <img src=?> <script src=# language=JavaScript></script> </div>  */// ;
Perl in GIF GIF89a(q /*....../ );sub GIF89a{print &quot;Hello Perl!&quot;} __END__ #*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div>  */// ;
Demo
 
 
Thank you

More Related Content

Viewers also liked

Viewers also liked (6)

HTML5 for Security Folks
HTML5 for Security FolksHTML5 for Security Folks
HTML5 for Security Folks
 
Application Security Vulnerabilities: OWASP Top 10 -2007
Application Security Vulnerabilities: OWASP Top 10  -2007Application Security Vulnerabilities: OWASP Top 10  -2007
Application Security Vulnerabilities: OWASP Top 10 -2007
 
OAuth 2.0 & Security Considerations
OAuth 2.0 & Security ConsiderationsOAuth 2.0 & Security Considerations
OAuth 2.0 & Security Considerations
 
Application Security Risk Rating
Application Security Risk RatingApplication Security Risk Rating
Application Security Risk Rating
 
Security Automation using ZAP
Security Automation using ZAPSecurity Automation using ZAP
Security Automation using ZAP
 
Polyglot payloads in practice by avlidienbrunn at HackPra
Polyglot payloads in practice by avlidienbrunn at HackPraPolyglot payloads in practice by avlidienbrunn at HackPra
Polyglot payloads in practice by avlidienbrunn at HackPra
 

More from takesako

SECCON CTF セキュリティ競技会コンテスト開催について
SECCON CTF セキュリティ競技会コンテスト開催についてSECCON CTF セキュリティ競技会コンテスト開催について
SECCON CTF セキュリティ競技会コンテスト開催について
takesako
 
Acme::MineChan LT demo
Acme::MineChan LT demoAcme::MineChan LT demo
Acme::MineChan LT demo
takesako
 
Node.js - JavaScript Thread Programming
Node.js - JavaScript Thread ProgrammingNode.js - JavaScript Thread Programming
Node.js - JavaScript Thread Programming
takesako
 
Node.js - sleep sort algorithm
Node.js - sleep sort algorithmNode.js - sleep sort algorithm
Node.js - sleep sort algorithm
takesako
 
正規表現‐もう一つのバベルの塔‐木村浩一
正規表現‐もう一つのバベルの塔‐木村浩一正規表現‐もう一つのバベルの塔‐木村浩一
正規表現‐もう一つのバベルの塔‐木村浩一
takesako
 
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
takesako
 
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser DetectionShibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
takesako
 

More from takesako (19)

SECCON CTF セキュリティ競技会コンテスト開催について
SECCON CTF セキュリティ競技会コンテスト開催についてSECCON CTF セキュリティ競技会コンテスト開催について
SECCON CTF セキュリティ競技会コンテスト開催について
 
Acme minechan
Acme minechanAcme minechan
Acme minechan
 
Acme::MineChan LT demo
Acme::MineChan LT demoAcme::MineChan LT demo
Acme::MineChan LT demo
 
Node.js - JavaScript Thread Programming
Node.js - JavaScript Thread ProgrammingNode.js - JavaScript Thread Programming
Node.js - JavaScript Thread Programming
 
Node.js - sleep sort algorithm
Node.js - sleep sort algorithmNode.js - sleep sort algorithm
Node.js - sleep sort algorithm
 
x86x64 SSE4.2 POPCNT
x86x64 SSE4.2 POPCNTx86x64 SSE4.2 POPCNT
x86x64 SSE4.2 POPCNT
 
再帰的 正規表現JSON Validator
再帰的 正規表現JSON Validator再帰的 正規表現JSON Validator
再帰的 正規表現JSON Validator
 
正規表現‐もう一つのバベルの塔‐木村浩一
正規表現‐もう一つのバベルの塔‐木村浩一正規表現‐もう一つのバベルの塔‐木村浩一
正規表現‐もう一つのバベルの塔‐木村浩一
 
Perl6 Regex Programming with Rakudo
Perl6 Regex Programming with RakudoPerl6 Regex Programming with Rakudo
Perl6 Regex Programming with Rakudo
 
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to usThat Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
 
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
 
Perl x86 JIT Programming
Perl x86 JIT ProgrammingPerl x86 JIT Programming
Perl x86 JIT Programming
 
YAPC::Asia 2008 Closing Ceremony
YAPC::Asia 2008 Closing CeremonyYAPC::Asia 2008 Closing Ceremony
YAPC::Asia 2008 Closing Ceremony
 
Devsumi2008 - YAPC::Asia 2008 Tokyo
Devsumi2008 - YAPC::Asia 2008 TokyoDevsumi2008 - YAPC::Asia 2008 Tokyo
Devsumi2008 - YAPC::Asia 2008 Tokyo
 
GIF89a Oldtype
GIF89a OldtypeGIF89a Oldtype
GIF89a Oldtype
 
Shibuyajs Digest
Shibuyajs DigestShibuyajs Digest
Shibuyajs Digest
 
HTML2.0 - digg - OSC2007-fall
HTML2.0 - digg - OSC2007-fallHTML2.0 - digg - OSC2007-fall
HTML2.0 - digg - OSC2007-fall
 
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser DetectionShibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
 
Shibuyajs24 JavaScript.GIF x LiveConnect
Shibuyajs24 JavaScript.GIF x LiveConnectShibuyajs24 JavaScript.GIF x LiveConnect
Shibuyajs24 JavaScript.GIF x LiveConnect
 

HTML Binary Hacks & GIF89a Ployglot

  • 1. HTML Binary Hacks - GIF89a Polyglot - Cybozu Labs, Inc. TAKESAKO <takesako@shibuya.pm.prg>
  • 2. I’ll show you, HTML 2.0 hacks.
  • 3. 1.0 HTML Browser Detection
  • 4. HTML Quiz <img src=”1.gif” src=”2.gif”> (1) 1.gif (2) 2.gif (3) N/A Answers. Q1. What will you see? (on your browser)
  • 5. Q2. What’s this? <img /src = ”1.gif” ”” src{00} = ”2.gif” ’ src{0c} = ”3.gif” src = ”4.gif” /> (1) 1.gif (2) 2.gif (3) 3.gif (4) 4.gif Answers. -> ie -> Safari -> firefox -> others
  • 6.
  • 7. print<<EOF; <img /src 00 =&quot;ie.gif&quot; /''src 00 =&quot;firefox1_5.gif&quot; /''src=&quot;firefox2_0.gif&quot; /&quot;&quot;src=&quot;gecko_others.gif&quot; &quot;s 00 rc=&quot;safari2.gif&quot; &quot;src=&quot;safari3.gif&quot; &quot;&quot;src=&quot;konqueror.gif&quot; src 00 =&quot;w3m.gif&quot; src 0c =&quot;opera.gif&quot; src=&quot;others.gif&quot; src=&quot;lynx.gif&quot; /> EOF
  • 9.  
  • 10. It can detect “Konqueror”, “Safari2” !
  • 11. No JavaScript & No CSS hacks
  • 12. lynx
  • 13. w3m
  • 14. Mozilla/5.0 (PLAYSTATION 3; 1.00)  others.gif
  • 15.
  • 18. Animation GIF image Yappoc.gif
  • 19. どう見ても Yappo です 本当にありがとう ございました(ry
  • 20. Polyglot DEMO HTML/CSS & JS & Perl & GIF89a
  • 21. JavaScript in GIF GIF89a( q /*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/ =1 );function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div> */ // ;
  • 22. HTML/CSS in GIF GIF89a(q/*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /* <body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1> <!-- ................................................ ................................................ ................................................ ................................................ --> <img src=?> <script src=# language=JavaScript></script> </div> */// ;
  • 23. Perl in GIF GIF89a(q /*....../ );sub GIF89a{print &quot;Hello Perl!&quot;} __END__ #*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div> */// ;
  • 24. Demo
  • 25.  
  • 26.