Download

Backdooring Image FilesIt is a lesser known fact that IE and some other browsers do not correctly identify fakeimages from real images.This peculiarity can be used by attackers to perform successful XSSexploitation on applications that correctly sanitize user-supplied input but fail to verify thecorrectness of uploaded images.Let’s start with a simple example and see how the attack technique works. Open yourfavorite text editor and create a simple HTML file with the following content:alert('XSS');For the next step of this demonstration you need a Web server. As previously discussedin this book, you can use Windows Apache MySQL PHP (WAMP) package or any otherserver that can serve static files.Put the newly created file inside your document root folder and change the extensionfrom .txt,.htm, or .html to .jpg.In my case, the test file is stored in c:\Wamp\www\test.jpg. In order to access the file, Ineed to visit http://localhost/test.jpg via IE. Notice that the browser does not complainabout the inconsistencies in the served image file and it happily displays the alert message asshown on Figure 4.26.Figure 4.26 IE Image XSS ExploitXSS Theory • Chapter 4 135