#data uri

[clye]

Awhile back, CSS-Tricks posted “Probably Don't Base64 SVG”, which concluded that SVGs in data: URIs are smaller used as-is instead of base64-encoded.It’s got the right idea, but there are a few...

[pentesttoolz]

LFiFreak - An automated LFi Exploiter with Bind/Reverse Shells

LFiFreak - An automated LFi Exploiter with Bind/Reverse Shells #LFI #Linux #InfoSec #Shell

LFiFreak is a tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods.

Features

Works with Windows, Linux and OS X

Includes bind and reverse shell for both Windows and Linux

Written in Python 2.7

Dependencies

BeautifulSoup

  Download LFiFreak

View On WordPress

[insidehtml5]

I've created a utility for converting an image to data URI using JavaScript.

[redesignd]

[scribble] Base64 Encoding for Data URI Scheme

[this post is just a short reminder for myself]

included image with css:

.tumblr_test {     width: 200px; height: 200px;     background-image: url(http://assets.tumblr.com/images/logo_page/img_logo_34465d_2x.png); }

convert image to base 64 encoding (e.g. by shell command):

base64 img_logo_34465d_2x.png | tr --delete '\n' > output.txt

replace the url reference with the encoded output:

.tumblr_test {     width: 200px; height: 200px;     background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAYAAACtWK6eAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAABQFJREFUeNrs3X/IXXMcwPFzPdtfZPNz2pjUWrYsaT1bfjNjjPJrKGVNlEQtoZCS2hR/+ENKImny4y+J8jNr/CMNDS35kSIiPzJ/IL+6Pt/OKc/dPffybM859/k+e73qk/3DuX3O894998d5dLrdbgHU6wgEBAICAYGAQEAgIBAQCAgEBAIIBAQCAgGBgEBAICAQEAgIBARiCyAQEAgIBAQCAgGBgEBAICAQQCAgEBAICAQEAgIBgYBAQCAgEEAguxlfs95PQI3tr2yxhMp+VgACGZV7YrpTNAhkxjnPCgTCYIusQCDUWxBzgDUIhHqLrUAgDLbcCgTCYCutQCDU68ScZg0Cod5xMYdbg0Cod74VCITBLrICgVDvmJgV1iAQ6m2oXqQjEHYzqwoEgVDjkpiF1iAQ+qXLqlusQSDUS+9cjVuDQOg3FrPJGgRCvRtjllqDQOh3lGcPgTD40uqxwo1RAqHWbTGrrUEg9FsVc7c1CIR+y2KerS6xEAgTLIl5OWaOVQiEXifEbIuZbxUCodc5MVsLdwoKhB7pO1bp3aoXY+Zax75llhUMdWTMwzFrrcIzCL17uT5mpzg8g9Dr7Jh7qxfk00kTv+HdnY8C+V9mF+XNThtjTrQOBPKvzTHXxMyzCgTS7w4rwIt0EAgIBAQCAgGBgEBAICAQQCAgEBAICAQEAgIBgcDM4IapPb8vu5vBY8QzCAgEBAICAYGAQEAgIBBAICAQEAgIBAQCAgGBgEBAIIBAQCAgEBAICAQEAgIBgYBAQCCAQEAgIBAQCAgEBAICoSn+T2ACYYiDrEAgCEQgM8ifLR7rWOsWSG5+bfFYx1u3QHLzQ4vHWmPdAsnNVy0e66SYRVYukJx83eKxOjG3W7lAcvJhy8e7OuYsaxdILna0fLz0LPKMF+wCycU7Md2Wj3lozJsxV1XB7IkjYm6KucApFEiT0rtYH4zguAfGbInZHnNt9QM/yOyYJTHrYu6Pebd6cyH9+Qan8L/5js/eeXWElzzLYx6Z8IbB5zG/Vc9q6ZP3eTHzq0jqpNczh8T86DQKpCnPxdw6DR7HgmomI4VzccyjTqNLrKa8Vf3NnasrnEKBNCldzjyZ8eM/M+Ywp1EgTUqXKH9l+tjHYi51CgXSpC9jnsr48V/uFAqkaZuKdr/+PpVOL4a/VSwQ9tqnMQ9l/DOwzikUSNPuivnGZZZAqLcr5rpMH/vJxeQ/RxEIk/ZCzIOZ/hxc5vQJpA03x7yR4eP2oaFAWvFH9bfxzswe98qYhU6fQNrwfVHeR55TJB2XWQJpU/qG7akx21xmCYR6P8WcG/N4Jo/3Y6dMIG37vSjvJ19fBTMdpe+SbY7Z4HQJZFSeiFka83TR/q26w6Sv7J8Sc2fM306TQEbp25grY8Zjnh9hKOm46a3otUX5O7fedmoEMp2ke8MvLMrfuftAzHctHfeLmPuK8j71M2JeciqGc8vtaH0Ss7EoP1xM36pdHbOqKO83H5uC//4vRfnLHbYW5af8O6xcIDlKL5JfryaZE7MiZlnM4piji/K7UgfH7B8zd8K/m17476r+md5a/izmo5j3Yt4v8r2ZSyAM9HPMa9XgNQhMT51ut2sLIBAQCAgEBAICAYGAQEAgIBBAICAQEAgIBAQCAgGBgEBAICAQQCAgEBAICAQEAgIBgYBAQCCAQEAgIBAQCAgEBAICAYGAQGBf9Y8AAwAfs3v5k7Z++gAAAABJRU5ErkJggg=='); }

[roomthily]

[wprl]

Two Cool Data URIs

Put these data URIs in your URL bar to see a couple simple editors.

I forget where I saw this one. It's a super simple text editor. It's just a body tag with the contenteditable attribute set.

data:text/html,%3Cbody%20contenteditable%3E%3C/body%3E

This one was found in a comment to a blog article that has since been removed! The comment was by @oncletom, but it could originally come from somewhere else. (Who knows?) It loads a stylesheet and some javascript from GutHub with link tags.

data:text/html,%3Clink%20href=%22https://raw.github.com/marijnh/CodeMirror/master/lib/codemirror.css%22%20rel=%22stylesheet%22%20type=%22text/css%22%3E%3Cscript%20src=%22https://raw.github.com/marijnh/CodeMirror/master/lib/codemirror.js%22%3E%3C/script%3E%3Cscript%20src=%22https://raw.github.com/marijnh/CodeMirror/master/mode/javascript/javascript.js%22%3E%3C/script%3E%3Clink%20href=%22https://raw.github.com/marijnh/CodeMirror/master/doc/docs.css%22%20rel=%22stylesheet%22%20type=%22text/css%22%3E%3Cstyle%20type=%22text/css%22%3E.CodeMirror%20%7Bborder-top:%201px%20solid%20black;%20border-bottom:%201px%20solid%20black;%7D%3C/style%3E%3Ch1%3EJavaScript%20code%20editor%3C/h1%3E%3Ctextarea%20id=%22code%22%20name=%22code%22%3E%3C/textarea%3E%3Cscript%3Evar%20editor%20=%20CodeMirror.fromTextArea(document.getElementById(%22code%22),%20%7BlineNumbers:%20true,matchBrackets:%20true%7D);%3C/script%3E

Cheers, William

[gpessia]

Data URI & Encoding Schemes in Sublime Text 2

Oggi come oggi spesso ti ritrovi a dover convertire qualche file o sequenza di caratteri in qualche formato *strano*. Ad esempio convertire una qualche immagine o font con [data URI](http://en.wikipedia.org/wiki/Data_URI "Wikipedia Entry: Data URI scheme") ([Base64](http://en.wikipedia.org/wiki/Base64 "Wikipedia Entry: Base64") encoded) per [includerla direttamente](http://css-tricks.com/data-uris/ "Data URIs | CSS-Tricks") in un foglio di stile e diminuire in questo modo le richieste HTTP, o recuperare qualche dato da un DB sostituendolo con una sequenza in MD5. Sublime Text ha delle estensioni comodissime che possono dare una grossa mano nel velocizzare questi processi, sarà che un po' odio i tools on-line e ce ne sono a vagonate, preferisco restare sull'editor per fare certe cose, al massimo uso il terminale. ### Hasher Il primo che consiglio è [Hasher](https://github.com/dangelov/hasher "dangelov/hasher · GitHub") comodissimo per codificare testo. Basta selezionare quel che si vuole e richiamare la funzione tramite Command Palette ( ⇧⌘P )  Hasher al momento supporta: - MD5 - SHA1 - Base64 Encode - Base64 Decode - URI Component Encode - URI Component Decode - Entity Encode - Entity Decode ### SideBarEnhancements Il secondo che consiglio è [SideBarEnhancements](https://github.com/titoBouzout/SideBarEnhancements "titoBouzout/SideBarEnhancements · GitHub"), secondo solo perchè questo tipo di utilizzo non è la sua peculiarità ma una funzione tra le tante. Per chi volesse saperne di più su SidebarEnhancements Tutspuls ha dedicato [un intero video](https://tutsplus.com/lesson/sidebar-enhancements/ "Tuts+ Premium Course: Perfect Workflow in Sublime Text 2 - Sidebar Enhancements") di [Perfect Workflow in Sublime Text 2](https://tutsplus.com/course/improve-workflow-in-sublime-text-2/ "Tuts+ Premium Course: Perfect Workflow in Sublime Text 2") alle sue straordinarie capacità. Quello che SidebarEnhancements fa bene è convertire files, immagini o font in Base64 e renderli disponibili in Data URI per così poi includerli dove vogliamo.  Basta selezionare il file desiderato, tasto destro poi Copy as Text > Content as Data URI. Ci ritroveremo in memoria il codice e possiamo a questo punto incollarlo dove vogliamo.

[dragoni]

Downside of data URI's is security!

It appears that the worm took advantage of Tumblr's reblogging feature, meaning that anyone who was logged into Tumblr would automatically reblog the infectious post if they visited one of the offending pages.

The Base 64 string was actually encoded JavaScript, hidden inside an iFrame that was invisible to the naked eye, that dragged content from a url. Once decoded, the intention of the code becomes more clear.