Ethical Hacker Community Forums

Injecting xss or shell in picture(jpeg or etc) works very nice.I made my small childish lab last night and was tring to actually injecting a virus(.exe) in a picture and then hosted it.So when I tested on me,it did not infect me..is it possible actually to small .exe servers in pics...


I know it's Unethical,just for knowledge purpose.Hope you understand.

You can find it easily on the web. And if you can't find it then probably this info is not safe in your hands.

I just want to know,is it possible for an exe format to act like a mp3..?Only binding won't work here..please help

Try working your way through these; http://www.hellboundhackers.org/challenges/stegano/index.php (http://www.hellboundhackers.org/challenges/stegano/index.php). You'll have to register at that site first. Once you've done the challenges, I believe that you'll be able to answer your own question.

Thanks for the link Negrita!  It looks like a cool site.

My pleasure.  :)

Thans for the link.

But it's more of steganography,steg will only hide the data,but it won't be executed..??

I think you will find what you are trying to do is difficult, unless you force the pic to open as an html and exploit the browser. 

Most of the stuff I've seen revolves around buffer overflows that occur when images(GIF, ANI, etc) are processed and shellcode is tacked on. I believe with the onload function in javascript and probably activeX as well, you can have whatever you want executed when the image is loaded on the page.

Apparently this garnered some attention at BlackHat this week.  Rich Mogull gave a little write up about it over on Securosis (http://securosis.com/2008/08/07/black-hat-the-risks-of-trusting-content/), but I've been seeing a lot of others talking about it, too.

Oneeyedcarmen,

thanks for the link, I haven't come across that attack vector before. Unfortunately it sounds fairly promising (one more reason to disable javascript, thank you NoScript).

Was anyone at this talk @ Blackhat? more technical information regarding the vector would be good.

a few of our lurkers and occasional posters were there, so hopefully we'll get some more detail when they return

Here is a link from one of the presenters with some information about it.

http://blogs.zdnet.com/security/?p=1666 (http://blogs.zdnet.com/security/?p=1666)

Nate and Rob discuss the GIFAR talk on the Network Security Podcast (http://netsecpodcast.com/?p=69)