SlideShare a Scribd company logo
HTML Binary Hacks - GIF89a Polyglot - Cybozu Labs, Inc. TAKESAKO <takesako@shibuya.pm.prg>
I’ll show you,  HTML 2.0 hacks.
1.0 HTML Browser Detection
HTML Quiz <img src=”1.gif” src=”2.gif”> (1) 1.gif  (2) 2.gif  (3) N/A Answers. Q1. What will you see?  (on your browser)
Q2. What’s this? <img /src  = ”1.gif” ”” src{\x00} = ”2.gif” ’ src{\x0c} = ”3.gif” src  = ”4.gif” /> (1) 1.gif  (2) 2.gif (3) 3.gif (4) 4.gif Answers. ->   ie ->   Safari ->   firefox ->   others

print<<EOF; <img /src \x00 =&quot;ie.gif&quot; /''src \x00 =&quot;firefox1_5.gif&quot; /''src=&quot;firefox2_0.gif&quot; /&quot;&quot;src=&quot;gecko_others.gif&quot; &quot;s \x00 rc=&quot;safari2.gif&quot; &quot;src=&quot;safari3.gif&quot; &quot;&quot;src=&quot;konqueror.gif&quot; src \x00 =&quot;w3m.gif&quot; src \x0c =&quot;opera.gif&quot; src=&quot;others.gif&quot; src=&quot;lynx.gif&quot; /> EOF
http://wafful.org Demo
 
It can detect “Konqueror”, “Safari2” !
No JavaScript & No CSS hacks
lynx
w3m
Mozilla/5.0 (PLAYSTATION 3; 1.00)    others.gif

1.0 The End
2.0 GIF89a Polyglot
Animation GIF image  Yappoc.gif
どう見ても Yappo です 本当にありがとう ございました(ry
Polyglot DEMO HTML/CSS & JS & Perl & GIF89a
JavaScript in GIF GIF89a( q /*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/ =1 );function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div>  */ // ;
HTML/CSS in GIF GIF89a(q/*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /* <body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1> <!-- ................................................ ................................................ ................................................ ................................................ --> <img src=?> <script src=# language=JavaScript></script> </div>  */// ;
Perl in GIF GIF89a(q /*....../ );sub GIF89a{print &quot;Hello Perl!&quot;} __END__ #*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div>  */// ;
Demo
 
 
Thank you

More Related Content

PPTX
2013 e guidebook
PDF
Youth Tactical Training
PPT
4887867.ppt
PDF
DOCUMENTOS FIFA - 10 - EL JUGADOR DE MAÑANA
DOC
Football Coaches Weekend and Weekly Schedule
PPTX
Soccer drills
PDF
US Youth Soccer Practice Activities (U10)
PDF
US Youth Soccer Practice Activities (U12)
2013 e guidebook
Youth Tactical Training
4887867.ppt
DOCUMENTOS FIFA - 10 - EL JUGADOR DE MAÑANA
Football Coaches Weekend and Weekly Schedule
Soccer drills
US Youth Soccer Practice Activities (U10)
US Youth Soccer Practice Activities (U12)

Viewers also liked (6)

PDF
HTML5 for Security Folks
PPTX
Application Security Vulnerabilities: OWASP Top 10 -2007
PPT
OAuth 2.0 & Security Considerations
PPTX
Application Security Risk Rating
PDF
Security Automation using ZAP
PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
HTML5 for Security Folks
Application Security Vulnerabilities: OWASP Top 10 -2007
OAuth 2.0 & Security Considerations
Application Security Risk Rating
Security Automation using ZAP
Polyglot payloads in practice by avlidienbrunn at HackPra

More from takesako (19)

PDF
SECCON CTF セキュリティ競技会コンテスト開催について
PDF
Acme minechan
PDF
Acme::MineChan LT demo
PPTX
Node.js - JavaScript Thread Programming
PPTX
Node.js - sleep sort algorithm
PPTX
x86x64 SSE4.2 POPCNT
PPTX
再帰的 正規表現JSON Validator
PDF
正規表現‐もう一つのバベルの塔‐木村浩一
PDF
Perl6 Regex Programming with Rakudo
PDF
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
PDF
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
PDF
Perl x86 JIT Programming
PPT
YAPC::Asia 2008 Closing Ceremony
PDF
Devsumi2008 - YAPC::Asia 2008 Tokyo
PPT
GIF89a Oldtype
PPT
Shibuyajs Digest
PPT
HTML2.0 - digg - OSC2007-fall
PPT
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
PPT
Shibuyajs24 JavaScript.GIF x LiveConnect
SECCON CTF セキュリティ競技会コンテスト開催について
Acme minechan
Acme::MineChan LT demo
Node.js - JavaScript Thread Programming
Node.js - sleep sort algorithm
x86x64 SSE4.2 POPCNT
再帰的 正規表現JSON Validator
正規表現‐もう一つのバベルの塔‐木村浩一
Perl6 Regex Programming with Rakudo
That Goes Without Alpha-Num (or Does It ?) all your base10 are belong to us
Devsumi2010 Ecmascript5 (ISO/IEC JTC1/SC22)
Perl x86 JIT Programming
YAPC::Asia 2008 Closing Ceremony
Devsumi2008 - YAPC::Asia 2008 Tokyo
GIF89a Oldtype
Shibuyajs Digest
HTML2.0 - digg - OSC2007-fall
Shibuya.pm#8 - ImageFight - HTML 2.0 New Browser Detection
Shibuyajs24 JavaScript.GIF x LiveConnect

HTML Binary Hacks & GIF89a Ployglot

  • 1. HTML Binary Hacks - GIF89a Polyglot - Cybozu Labs, Inc. TAKESAKO <takesako@shibuya.pm.prg>
  • 2. I’ll show you, HTML 2.0 hacks.
  • 3. 1.0 HTML Browser Detection
  • 4. HTML Quiz <img src=”1.gif” src=”2.gif”> (1) 1.gif (2) 2.gif (3) N/A Answers. Q1. What will you see? (on your browser)
  • 5. Q2. What’s this? <img /src = ”1.gif” ”” src{\x00} = ”2.gif” ’ src{\x0c} = ”3.gif” src = ”4.gif” /> (1) 1.gif (2) 2.gif (3) 3.gif (4) 4.gif Answers. -> ie -> Safari -> firefox -> others
  • 6.
  • 7. print<<EOF; <img /src \x00 =&quot;ie.gif&quot; /''src \x00 =&quot;firefox1_5.gif&quot; /''src=&quot;firefox2_0.gif&quot; /&quot;&quot;src=&quot;gecko_others.gif&quot; &quot;s \x00 rc=&quot;safari2.gif&quot; &quot;src=&quot;safari3.gif&quot; &quot;&quot;src=&quot;konqueror.gif&quot; src \x00 =&quot;w3m.gif&quot; src \x0c =&quot;opera.gif&quot; src=&quot;others.gif&quot; src=&quot;lynx.gif&quot; /> EOF
  • 9.  
  • 10. It can detect “Konqueror”, “Safari2” !
  • 11. No JavaScript & No CSS hacks
  • 12. lynx
  • 13. w3m
  • 14. Mozilla/5.0 (PLAYSTATION 3; 1.00)  others.gif
  • 15.
  • 18. Animation GIF image Yappoc.gif
  • 19. どう見ても Yappo です 本当にありがとう ございました(ry
  • 20. Polyglot DEMO HTML/CSS & JS & Perl & GIF89a
  • 21. JavaScript in GIF GIF89a( q /*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/ =1 );function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div> */ // ;
  • 22. HTML/CSS in GIF GIF89a(q/*....../);sub GIF89a{print &quot;Hello Perl!&quot;} __END__#*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /* <body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1> <!-- ................................................ ................................................ ................................................ ................................................ --> <img src=?> <script src=# language=JavaScript></script> </div> */// ;
  • 23. Perl in GIF GIF89a(q /*....../ );sub GIF89a{print &quot;Hello Perl!&quot;} __END__ #*/=1);function GIF89a(){alert(&quot;Hello JavaScrpt!&quot;)} /*<body style=visibility:hidden> <div style=position:relative;visibility:visible> <h1>Hello HTML!</h1><!-- ................................................ ................................................ ................................................ ................................................ --><img src=?> <script src=# language=JavaScript></script></div> */// ;
  • 24. Demo
  • 25.  
  • 26.