Well... This is a really bad, bad thing Micro $ oft has done (Again !!!) With IE. They let IE render jpg images with html in them! Even if there is no image! And check this out, this is how easy it is.
Step 1:
Download Notepad ++ (Its free). You can do this with notepad but, notepad ++ is much better (It has lots of plugins etc .).
Step 2:
Make a new txt file. Open it with notepad/notepad ++ and add the following lines:
<Html>
<Body>
<Script> alert (XSS); </script>
</Body>
</Html>
Step 3:
Remove the. txt and rename to. jpg. Open in IE ....
Simple right !!!!! How dumb are they? Allowing html in a jpg to render with no problems!
Note: This will not work if the image is embedded in a page. it must be linked directly. if it wocould work when embedded in html this forum wocould be vulnerable (Injecth4x or Volume might want to fix that... scratch that. you definitely want to fix that ). volume said it wasnt working on his Internet Explorer so maybe its patched. it is confirmed working in IE 7.0.60001.18000 and earlier.
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
