jklmnn / imagejs Goto Github PK

View Code? Open in Web Editor NEW

901.0 37.0 118.0 50 KB

Small tool to package javascript into a valid image file.

License: GNU General Public License v3.0

C 97.40% CMake 2.60%

injection xss

imagejs's Introduction

imagejs

Small tool to package javascript into a valid image file.
Currently supported are gif and bmp.

Disclaimer

This program is just a proof of concept example. It may contain bugs and it is only tested with valid inputs. Do NOT pass untrusted data to this program.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Building

To build this tool, build-essential and cmake are required (this is for Debian and Ubuntu based systems, for any other system please refer to its documentation). After installing the dependencies, run the following commands:

$ git clone https://github.com/jklmnn/imagejs.git
$ cd imagejs
$ mkdir build
$ cd build
$ cmake ..
$ make

Usage

Run imagejs option jsfile.js. The outcoming image file will be named like the input file + the image ending.. Options are currently bmp, gif, webp, pnm and pgf.

If you add -l as flag you your image is written to the file so that you can open it and view your code as a line of pixels.
This is currently only supported for bmp files.

Example

$ ./imagejs bmp code.js -l
will return a file named code.js.bmp that is viewable.

Code can now be embedded into existing gif files by using the flag -i with a gif file as argument.
Example:
$ ./imagejs gif code.js -i giffile.gif

This is currently available for gif, bmp, webp, where webp is still beta.

Supported output files are: gif, bmp, webp, pnm, pgf

Background:

This tool allows you to create a picture file that is able to run javascript code. A file like this is able to extend XSS vulnerabilities. For example, if you are able to put a script tag on a website but cant run the script because it only runs scripts from this website, you can just upload e.g. a profile picture containing the code you want to run. The idea came from Ajin Abraham and I put it in C code and also added the ability to do the same thing also with bitmap files.

imagejs's People

Contributors

Stargazers

Watchers

Forkers

lordsaibat simonrutter rapzo blackout314 petrbrzek robbestad shanbady fengweijp inno-v hodgesds darnyte keichacon roadlabs mxr0 gkhighelf zjhiphop davymacca techslides chosen1 eddiewu robertjgabriel xingyan cmbaughman dipsec yiniyin greg5678 pentestbox jesusalc pombredanne mauriciodarocha murugespandian olivierh59500 abnermachado tlahtoani clicknull av1080p zgsxwsdxg yaoyi2008 zenxiaoshu 177ysk rybnik newbiethetest mikalv 2xlink knowlet hugzug sweettddy xamelion expertasif sect9 mrread wanghui0720 krishna2nd benedict-erwin benjizle pir8aye venusdharan dev0p0 cargabsj175 brianelugan99 taihuynhpt 0xbadca7 srgtcauliflour ryuuyuki 1-4 exploit-inters signedbytes siddharthsa freddywaiganjo meai1 tzubal jangelesg security-geeks marklakshma parag85 undeadinu 0x43f 8l4nk evgenisabev cariaga 141801 ntgitdude23 ik-bounty ignitionlab seabreg s4ndxyz cubu sp0x 5l1v3r1 loctv hackingbharat dholiday ncupeterpan mixintu obnoxshuz zumb08 hartl3y94 nonxlabs g00sifer chaosxcode

imagejs's Issues

ImageJS and jQuery

Supposed to put jquery in the Image I have the error

Uncaught TypeError: number is not a function

The GIF header is ok, the error is somewhere in the javascript closure of JQuery

GIF89a/*0;*/=0
(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9//....

I started from a compressed version of jQuery 2.1.1 (jQuery minified) available on jQuery CDN

https://code.jquery.com/jquery-2.1.1.min.js

Who to contact for security issues

Hey there!

I belong to an open source security research community, and a member (@geeknik) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Support for jpeg?

just it give support for jpeg ?

Doesn't work with chrome

Hi there,
chrome shows an error: "Refused to execute script because its MIME type ('image/gif') is not executable."
Any ideas?

Thanks in advance,
Andreas

Can't execute JS code while displaying an image

Hi. I just tested your tool and my example image does not execute js code.
Can you write me an of working example of using your tool?

please mention how to run this software in terminal in kali 2018

after running git clone "https://github.com/jklmnn/imagejs" in terminal in kali linux 2018 the program is downloaded but there is problem in running the program as per your video in youtube i cant run it in terminal . please mention in the site about runing the program.
imagejs is missing in the containning the video

No executable file found

So I just cloned this repo on my kali linux and when I switched to imagejs folder, there was no executable file and commands found in README.md didn't worked.

I hope this is will be fixed soon. Thank is advance.

don't work with Bmp file's

thank you for this good job.
i've built imagejs from github.
it's ok for Gif file but don't work with Bmp file .
i've tested the 2 option -l and -i but alwys the same problem " don't display my js code on html".
ive run strings on the file.js.bmp generated with imagejs and i've got on the end of code this:
*/;alert("Hello\nHow are you?");
maye be */; block displaying "alert("Hello\nHow are you?");" when i call it like this :

please help to run it with Bmp file's

Output image size

While using the command: /imagejs gif code.js -i img.gif
After the header injection on a gif image, the ouput is a image with 10799x615 and ouput is 615x615.

Is the header injection messing with the file size?

After i saw this:
WIDTH equ 10799 ; equivalent to 2f2a, which is '/*' in ASCII, thus starting an opening comment

I notice this in the header

const char _gif_header[8] = {0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x2f, 0x2a};

Is this related?

Make on Windows failed

When I did make on Windows 7 x64 I received the error

make: Interrupt/Exception caught (code = 0xc00000fd, addr = 0x4227d3)

What do you think to attach the built exe-file into releases page?

Uncaught syntaxError: Illegal character

After injecting code into the image and then I load into the script tag to run the Javascript but all the time it throws the same error: UNCAUGHT SYNTAXERROR: ILLEGAL CHARACTER.