New answers tagged

1

There is no way to get the password directly You can not get the user password directly from the forum. Simply because you cannot access the browser using javascript. So you will not be able to get the saved passwords in the browser. This would be a huge security failure There are 2 ways to access an account from a XSS vulnerabilty As we saw, it isn't ...


2

If it is a secure CAPTCHA, the AJAX message will send the user's input to a server. The server will validate the input and return a token. The token will then be inserted into the form by the Javascript. When the form is submitted, the server will validate the token with the CAPTCHA service (this could be a web service call or signature validation). So the ...


1

If the validation (i.e. cheching that the user input matches the text on the CAPTCHA) is done client side, nothing is stopping you from bypassing it. You dont even have to read the code - just look at the HTTP request the AJAX send and copy it. This can be done with the developer tool in any browser. A very basic rule for web security is to never trust the ...


0

Firstly, I can see that this is a CSRF vulnerability, if you website has a JS which executes a GET request, then I see the following scenario: 1.-An attacker can see and analyze your JS code and use it for his/her purposes. 2.-The attacker could be build a website which includes your JS. <script ...


0

The first one - "You don't have permission to access this page" - doesnt sound like the browser. The second - "This page cannot be displayed" - could be. Different browsers react differently when they catch an XSS attack. If mode=block is set in the X-XSS-Protection header, both the latest version of Chrome and IE will give you a page similar to the one you ...


0

No, I don't think you can use it for XSS. Since the possibly unsafe object is passed to val() you should be fine. That function sets the value attribute. Whatever you set the value attribute to, you can not make it execute code. Since it manipulates the DOM and not the HTML source, something like this is completely safe in JavaScript: obj.value = '" ...


2

No. If the user input is properly encoded (HTML encoding in this context), XSS is not possible as user input will never be treated as JS code. Proper HTML encoding (conversion of input into their HTML entities) is the preferred way of preventing XSS when any user input is inserted/reflected back within HTML code. Your example seems to be a case of DOM ...


3

This code snippet is vulnerable to XSS in jQuery prior to 1.9 (and in conjunction with the jQuery Migrate plugin). Even now, it remains at least a bad practice. The string argument to $() (shortcut for jQuery()) can be parsed either as a CSS selector or HTML code. Parsing the string as HTML implies an XSS vulnerability, just as document.write() would. On ...


1

This was a pretty common XSS attack vector in jQuery, and can still affect sites using an outdated version of jQuery. https://bugs.jquery.com/ticket/9521 Basically, if a string was an invalid selector, jQuery would assume it was HTML, and parse it as HTML. In jQuery version 1.9 jQuery mitigated this risk by only parsing a string as HTML if it started with ...


0

The Malware creator might use the various points of redirection to change the behaviour of the script after it has been deployed to its target, maybe all systems are under the attackers control and he chooses to redirect different targets to different locations. Another possible answer is that the attacker prepared for the loss of access to one of the (most ...


7

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is certainly doomed. Never roll your own crypto. If your shared host doesn't support TLS, then find one that does, or else accept that your site is insecure. ...


0

There is no security bug here. If somepage.html links to malicious.html, they are both located on the same domain. It is expected behavior that the opened document malicious.html has a back reference via window.opener. In the same way somepage.html could access malicious.html by creating a handle for the opened document: var other = ...


0

If you only want to read additional data from the token (like JWT), it is no security threat. Since this part of the token is not even encrypted. If you want to expose some secret keys by hardcoding them or getting them from a web server to change and create a new token, that might be a subject of XSS and so on for example.


0

Yes, your SVG can easily be altered to execute arbitrary code. You have a reflected XSS vulnerability right there. When you have <svg width="<?php echo $_GET["name"];?>" height="100"> <circle cx="50" cy="50" r="40" stroke="green" stroke-width="4" fill="yellow" /> </svg> Set name be equal to 40"> <script> ...


3

You can attack these using the Z3 theorem prover. I've implemented such an attack in Python in order to predict values in a lottery simulator. As mentioned previously, XorShift128+ is used in most places now, so that is what we are attacking. You begin by implementing the normal algorithm so you can understand it. def xs128p(state0, state1): s1 = ...


4

Just a few small things, haven't figured out the thing entirely. Feel free to expand and comment on this. After we beautify the code, we get: http://pastebin.com/CdZ5BTfj We see: var C4 = new Array(0x3c, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74... And then a function function DC() { var Wb = C4.length, _yu = new Array(Wb), i; for (i = ...


1

We're working on methods to prevent users from ripping off his work and republishing it, or more so from reproducing it offline, be it on mugs, or similar. Sadly people either don't know, or don't care that it is illegal to steal someone's work and try to use it on mugs, shirts, etc, and try to sell it, as if it was their own... One easy step to ...


2

No, including the cookie name or username in the page is not an issue. The session/cookie name is not secret information, everybody can see it. [Including the content of the cookie on the other hand would be a minor problem, as session cookies are generally supposed to be httpOnly to mitigate some of the risks of XSS]. The users email address also should ...


0

I was able to sign with private key and verify the signature with public key, and I want to share with you. In SignXml() function I exported public key from private key: Dim publicKey as String = tmpRsa.ToXmlString(False) Then in the same function I call verifyXml() function: Dim verifySign As Boolean verifySign = VerifyXml(doc, publicKey) In ...


0

Ask nicely As the other answers here show, this is a social problem that isn't fully solved with technology alone. Consider adding a message such as: This artwork is my livelihood - if you like it, please buy a copy here (link to store) This can be just one part of your overall strategy - watermarking can be added just to the free-to-view versions, ...


2

Another easily-defeated trick is to create an “animated” GIF with a delay of 0 and a loop count of 1.  For example, download this:    and look at it in something other than a browser.  (I presume that there are tools that can get to the picture of the cat easily enough, but Microsoft Paint is not one of them.)  A slightly advanced version of this trick ...


1

You can use all the techniques you mention and to a certain extent it will hold people with less skills back, but the images are out there and in the last stage its up to the persons decision. So, don't forget to inform them. If they know there is copyright they can make an informed choice. Otherwise they just don't know if licensing applies. How can I ...


1

An idea: There is a watermark on money called the EURion constellation that tells printers not to reproduce it as one of the many safeguards against counterfeiting. A printer that sees this mark anywhere in an image should lock up, and it can be pretty small and innocuous. A quick google search shows that it's not always supported by printer manufacturers, ...


0

You can go the Deviant Art / Shutter Stock route and put a big watermark over the image when it is displayed on the public internet. Then have a paywall where users can then download unwatermarked original highres versions.


0

Ultimately, if you put an image of a certain quality on a screen there will always be some way of copying it. This is especially the case for cartoons etc where it is usually fairly trivial for a competent draftsman to copy a style, even if you make it difficult to download the digital image. I think that the pragmatic approach is to think strategically ...


0

Put a notice that you take copyright infringment seriously Take copyright infringment seriously Put protection for occasional users (you prevent just 90% of problems) Even hardest protections can be breaked Note that most copyright infringiments are due to users that want just to have some cool image to be posted on a forum or on a blog and may be simply ...


2

His cartoons are extremely detailed and heavily colored Creative solutions: Adapt the old map-making trick of hiding cartographer's name in a detailed area (see top answer on this GIS question). 'Supersize' it to spell their name across the cartoon. Promotes them without putting watermark across artwork. Try to match a grey watermark to the ...


4

I'm surprised no-one has mentioned Digimarc or the EURion Constellation yet. Digimarc Digimarc is a human-imperceivable digital watermark that embeds authorship information into a raster image. Adobe Photoshop (until the CC release) had the Digimarc Reader plugin built-in and would scan every image opened and display a warning to users if they opened a ...


2

Well, i've tackles this a few times. It's impossible to stop. I can bypass all these measures in 2 seconds, but they would scare me off because of the doubt if you are serious about persecuting. Use a canvas to draw the image from a byte stream supplied by a websocket. Disable right click via css. detect when printscreen has been ...


2

As mentioned in symcbeam's and Mike Manfrin's answers, if you want to make it impossible to download the image directly, you could break it up into several pieces and reassemble them on the page. This means there is no single element to save, which makes it significantly less convenient to make a copy of it, although of course it's still definitely possible ...


-1

One option is to add animation to your images. You can't screenshot animation. That also makes it a problem for selling hardcopy versions in comic form, though: fans will say "eh, it's not as good as on the web." There are plugins to record, for instance, YouTube videos, and flash files can be saved. However, the work required to create an animated tshirt ...


-2

Create an animated GIF from the image. Each frame shows part of the cartoon. Increase the GIF speed to the maximum possible. So, that way, to recreate the cartoon the person will have to copy-paste some pieces of the image. But it'll be fast enough so that the website user won't notice it's some animation. If you use few frames (say 3 up to 5), the GIF will ...


1

Break up the image in to multiple smaller images, and then use your frontend code to stitch them together. You will not need to implement blocking right clicks with this approach (which is horribly annoying). This form of protection will have no visible effect on the website, but will make it very difficult for people to simply take the images. People ...


0

In addition to some of the prevention methods already mentioned - disabling right click and using a transparent overlay - you can embed the image with metadata about the owner, author, company etc. It doesn't prevent them from copying the image, but it does make it much easier to find and prove they copied it if they do. It's funny to see just how many ...


1

It won't stop the "screenshot and open paint" approach but one thing you can do is to watermark the images and then when displaying the images in the web browser overlay another image over the first that removes the watermark. So one image on its own you see the cartoon with watermark. Second image on its own you just see the negative of the watermark. Put ...


1

I agree with everyone who says that there's no point in doing it technically and that you should rely on existing copyright law. Having said that, I once asked a S.O question, which I can't find, or recall the answer to (although I suspect it was "don't try, rely on the law"), where I suggested dividing the image into squares, like a chess board, then ...


3

If you are looking for things that make the image slightly harder to copy and arn't worried about handling things like screenshots, which are by definition lossy, then you may be interested to to try BASE64 encoding the images and putting them into the page's source. See here: http://stackoverflow.com/questions/1207190/embedding-base64-images This seem ...


7

Consider that an comic artist's business model is fandom. They make money by having fans*. Not so much because of the sales: sales happen because they have fans willing to pay. As such, limiting options, like lowering quality and so on, are the wrong solution to the problem. What you actually want is more fans willing to buy comics/merchandise etc. The ...


3

If right-click is disabled and the image can't be copied from a simple screen cap then your best bet is to make pulling the image from the browser buffer a nightmare. You can programmatically vivisect the image and have the image sections that get stored in the buffer require painstaking effort to rebuild into the original, emphasis on pain. Use the whole ...


55

You are seeking a technical solution to a social problem, if you want to call it one, which is often folly. One of the fundamental rules of security is that once you give the user something, they have it. Obfuscation and client-side "protection" (AKA DRM) do not work. If you want to display an image on user's screen screen, them saving that image can be no ...


19

Before doing things like this you always have to ask yourself: What is your actual goal? It is impossible to stop a determined attacker from getting your images, what you can do is make it harder for your average site visitor to get to the image. What does this gain you? Your artwork is still just as vulnerable to commercial exploits as it was before. ...


9

I've been faced with that problem several times. The best solution we found was to drastically reduce the image quality. Make it acceptable for the screen but too low quality to print out - even if it's a screenshot. This works very well for art work (paintings and photographs) but I'm not certain how well it will work for a cartoonist. The above solution ...


-8

If you use adobe flashplayer to display the images, it would be impossible to right click and download (it just shows adobe flash player options). Other methods might be able to get around it, but it would be difficult, especially if you only allow adobe flash player and admin to access the img's url. (if it has the right ip, then let it through, else, throw ...


8

There is nothing you do which makes it impossible for users to view the content without being able to save it. The best you can manage is to make it more difficult. And if you make it more difficult than acquiring legitimate usage rights then some (not all) of the people trying who might otherwise steal the content will pay for it - i.e. if you think the ...


93

There is no way to block saving of images, but here are some ideas to make it harder. To prevent right-clicking the image to save it, you can overlay a transparent div on it. The user will then right-click the div instead of the image below it and the context-menu will not show "Save image as". You could use a data URL to show the image so that there is no ...


47

If your problem is actually "convincing your client," try this thought experiment: Put a cartoon on a web page with a red border around it and a few diagonal stripes to partly obscure the image (just enough to make it ugly but still legible). Tell your client, "I've added unbreakable copy protection." Give your client a piece of paper and a pencil and ask ...


0

It's not clear what your threat models are or how you designate any of the nodes in the system as "trusted." Here's a short list of things you should have already considered: What happens if the primary API is compromised (e.g. hacker serves malicious javascript code from the API)? What happens if the connection between the primary API and the client is ...


2

Drive-by downloads are a real threat. These enable a website to exploit a 0-day vulnerability in your browswer to execute malicious code on your system. Note that sometimes websites are hacked to behave maliciously without the website's owners being malicious. While browser manufacturers work to fix security problems quickly, the 1534 publicly announced ...


1

I think you are confusing some things here. JavaScript is to be executed in the user's web browser. You can change the JavaScript in your browser as much as you like (with your browsers developer tools or alike) - but this will not have any effect on the server or other users. If you would manage to change the JavaScript for ALL users, this would be a ...


1

You cannot really do that without being illegal. There is a reason probably that you dont have admin access. And not having permission from the admin and doing it is also illegal.



Top 50 recent answers are included