+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Img src vulnerability? (/showthread.php?tid=6208732)
Img src vulnerability? - Newbyte - Jun 8, 2022
Hi everyone
I've found a website where i can inject Javascript but only certain html tags. Tags like script aren't accepted. However, the website does accept img tags so I can display images and call php scripts. All of this is fun and all but I was wondering if there is something more exciting that you can do with it like exploiting the website or getting the cookies of the page.
If anyone knows something, you can post it.
RE: Img src vulnerability? - linkinpork - Jun 8, 2022
(Jun 8, 2022 03:23 PM)Newbyte Wrote: I was wondering if there is something more exciting that you can do with it like exploiting the website or getting the cookies of the page.
If anyone knows something, you can post it.
Iframes, as in
< iframe src="https://linkinporkhf.github.io" >
Second answer in this StackOverflow thread shows how you can make a full-page version of it, essentially allowing you to totally deface the webpage https://stackoverflow.com/questions/17710039/full-page-iframe
RE: Img src vulnerability? - skull - Jun 8, 2022
In order to get the cookies, you must trigger some JavaScript.
But you can use the image src to send data your way once you found a way to gather it.
RE: Img src vulnerability? - Newbyte - Jun 9, 2022
(Jun 8, 2022 11:24 PM)shatter Wrote: The redirect from one of those examples can be used for an activity that is disallowed to be discussed here.
What do you mean?
RE: Img src vulnerability? - linkinpork - Jun 9, 2022
(Jun 9, 2022 03:24 AM)Newbyte Wrote: What do you mean?
https://hackforums.net/misc.php?action=help&hid=21
Listen to [mention=4963606] , he spends enough time in the Blackhat section to know this better than most.