Timeline for IMG tag vulnerability
Current License: CC BY-SA 3.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 30, 2017 at 7:14 | comment | added | Luc | @binki Edited the post to clarify/generalize one case. Later, I still mention SMF when it's specifically relevant, as "SMF forums", which you can totally look up without any doubts about which result is the correct one. | |
| Aug 30, 2017 at 7:11 | history | edited | Luc | CC BY-SA 3.0 |
Generalized/clarified SMF to "forum software" where the exact brand not relevant
|
| Nov 6, 2015 at 16:57 | comment | added | nodebase | @Luc: Right now I am adding the <img> to the page using document.createElement('img') and setting the src. If unauthorized, it prints the 401 error in the console. I execute this code from a bookmarklet that executes JavaScript. Do I need to be doing this some other way other than document.createElement() ? | |
| Nov 6, 2015 at 16:47 | comment | added | Luc | @nodebase Look in the HTTP headers. | |
| Nov 6, 2015 at 1:42 | comment | added | nodebase | How do I read the 401 response from trying to load an <img>? | |
| Sep 1, 2013 at 16:46 | comment | added | Xander | As you mentioned in your edit, 401 phishing is still a very real issue. It's an unfortunate side effect of the current implementation model for HTTP authentication in browsers. Nobody seems particularly interested in fixing it. | |
| Sep 1, 2013 at 16:37 | history | edited | Luc | CC BY-SA 3.0 |
Corrected a mistake
|
| May 28, 2013 at 10:34 | comment | added | Polynomial | I notified Google of the logout issue a couple of years ago, but they were uninterested. | |
| May 25, 2013 at 2:12 | comment | added | oreoshake | you can instruct the browser not to "sniff" the content (and execute it as such) with X-Content-Type-Options which is only supported by IE and chrome (citation needed). | |
| May 25, 2013 at 0:03 | comment | added | TildalWave | If this post seems hastily written, it is. I'm barely awake too hehe same here, at least you mentioned it, I... forgot to. Anyway, +1 ;) | |
| May 25, 2013 at 0:02 | comment | added | LSerni | +1 for the 401 attack. And this may be relevant: jira.atlassian.com/browse/… | |
| May 24, 2013 at 23:48 | history | answered | Luc | CC BY-SA 3.0 |