Skip to content

Latest commit

 

History

History
22 lines (16 loc) · 563 Bytes

README.md

File metadata and controls

22 lines (16 loc) · 563 Bytes

Image Polyglot

This program can craft a valid image that is simultaneously a valid and executable javascript file (polyglot). Its main use is to bypass CSP.

Main inspiration came from this article.

https://portswigger.net/research/bypassing-csp-using-polyglot-jpegs

Usage

JPG

./img_polygloter.py jpg --height 123 --width 321 --payload "alert(document.domain);" --output jpg_poly.js

GIF

./img_polygloter.py gif --payload "alert(document.domain);" --output gif_poly.js

TODO

  • gif dimensions, if possible
  • png crafting