Embed Size (px)
DESCRIPTION
http://conferences.yapcasia.org/ya2008/talk/1299
Citation preview
HTML Binary Hacks- GIF89a Polyglot -HTML Binary Hacks- GIF89a Polyglot -
Cybozu Labs, Inc.TAKESAKO
2
I’ll show you, HTML 2.0
hacks.
I’ll show you, HTML 2.0
hacks.
3
1.0HTML Browser
Detection
4
HTML QuizHTML Quiz
<img src=”1.gif” src=”2.gif”>
(1) 1.gif
(2) 2.gif
(3) N/A
Answers.
Q1. What will you see? (on your browser)
5
Q2. What’s this?Q2. What’s this?
<img /src = ”1.gif” ””src{\x00} = ”2.gif” ’src{\x0c} = ”3.gif” src = ”4.gif”/>
(1) 1.gif
(2) 2.gif
(3) 3.gif
(4) 4.gif
Answers.
→ ie→ Safari→ firefox→ others
6
7
print<<EOF;<img /src\x00="ie.gif" /''src\x00="firefox1_5.gif" /''src="firefox2_0.gif" /""src="gecko_others.gif" "s\x00rc="safari2.gif" "src="safari3.gif" ""src="konqueror.gif" src\x00="w3m.gif" src\x0c="opera.gif" src="others.gif" src="lynx.gif"/>EOF
http://wafful.org
Demo
9
10
It can detect “Konqueror”, “Safari2” !
11
No JavaScript&
No CSS hacks
12
lynx
13
w3m
14
Mozilla/5.0 (PLAYSTATION 3; 1.00)
others.gif
15
16
1.0TheEnd
17
2.0GIF89aPolyglot
18
Animation GIF image
Yappoc.gif
19
どう見てもYappo です
本当にありがとうございました（ｒｙ
20
Polyglot DEMO
HTML/CSS & JS & Perl & GIF89a
21
JavaScript in GIFJavaScript in GIF
GIF89a(q/*....../);sub GIF89a{print "Hello Perl!"}
__END__#*/=1);function GIF89a(){alert("Hello JavaScrpt!")}
/*<body style=visibility:hidden>
<div style=position:relative;visibility:visible>
<h1>Hello HTML!</h1><!--
................................................
................................................
................................................
................................................
--><img src=?>
<script src=# language=JavaScript></script></div>
*/// ;
22
HTML/CSS in GIFHTML/CSS in GIF
GIF89a(q/*....../);sub GIF89a{print "Hello Perl!"}
__END__#*/=1);function GIF89a(){alert("Hello JavaScrpt!")}
/*<body style=visibility:hidden>
<div style=position:relative;visibility:visible>
<h1>Hello HTML!</h1><!--
................................................
................................................
................................................
................................................
--><img src=?>
<script src=# language=JavaScript></script></div>
*/// ;
23
Perl in GIFPerl in GIF
GIF89a(q/*....../);sub GIF89a{print "Hello Perl!"}
__END__#*/=1);function GIF89a(){alert("Hello JavaScrpt!")}
/*<body style=visibility:hidden>
<div style=position:relative;visibility:visible>
<h1>Hello HTML!</h1><!--
................................................
................................................
................................................
................................................
--><img src=?>
<script src=# language=JavaScript></script></div>
*/// ;
24
Demo
25
26
27
Thank you
