Collaborate Disseminate
If an SVG file with an XSS payload is hosted on say cdn.example.com and is loaded as a display picture on say mainprod.com, can the XSS payload within the SVG file access and steal cookies from mainprod.com despite the Same-Origin Policy (… Continue reading SOP (Same Origin Policy) and CDN SVG XSS
Although some of the first Android-powered smartphones had them and Blackberries were famous for them, physical keyboards on portable electronics like that quickly became a thing of the past. Presumably …read more Continue reading Thin Keyboard Fits in Steam Deck Case
By Deeba Ahmed
Undetected for Over 11 Months, AsyncRAT Lurked on Systems of Sensitive US Agencies with Critical Infrastructures, reports the…
This is a post from HackRead.com Read the original post: AsyncRAT Infiltrates Key US Infrastructure Thro… Continue reading AsyncRAT Infiltrates Key US Infrastructure Through GIFs and SVGs
If you plan to attend Supercon or some other hacker conference, know that you’re going to get a badge with a SAO (Simple Add-On) connector, a 4-pin or 6-pin connector …read more Continue reading Jolly Wrencher SAO, And How KiCad 6 Made It Easy
If you played many games back in the mid-80s to 90s, you might remember the iconic graphics from Sierra’s Online Adventure Games. They were brightly colored (16 colors) and dynamic …read more Continue reading Upscaling The Sierras
My understanding is that:
SVGs offer far greater functionality if they are directly embedded in a site’s HTML code via the <svg> tag than if they are linked to via the <img> tag
For example, if the <svg> tag is used, it… Continue reading Is it practically possible to use SVGs to their full potential while still enjoying all protections offered by Content Security Policy (CSP)?
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading external fonts. And unlike using an <… Continue reading What sandbox does an <object> element run in? Can this sandbox be configured?
Since SVG files can have JavaScript, which would get executed is it a potential threat for malware, tracking scripts and similar stuff?
Continue reading Can SVG be a potential threat for tracking scripts and similar?
We’ve all marveled at the high quality PCB artwork used within the #BadgeLife and other communities to produce eye-catching designs, but those of you who have dipped your toes in the PCB artwork water will know that it’s hardly an …read more
I am currently doing a bug bounty program and was testing the company’s file upload functionality. After meddling with the functionality for a while, I was able to change the extension of the uploaded file to ‘.svg’ using burpsuite. I have… Continue reading File Upload Vulnerability SVG