{"id":877,"date":"2020-05-09T04:07:05","date_gmt":"2020-05-09T03:07:05","guid":{"rendered":"http:\/\/zerothcode.com\/blog\/?p=877"},"modified":"2020-10-08T05:12:03","modified_gmt":"2020-10-08T04:12:03","slug":"pixel-steals-data-im-invisible","status":"publish","type":"post","link":"https:\/\/zerothcode.com\/blog\/pixel-steals-data-im-invisible\/","title":{"rendered":"Pixel That Steals Data – I\u2019m Invisible"},"content":{"rendered":"

Summary :<\/strong><\/p>\n

A vulnerability using which an attacker can obtain the information of all the users without their knowledge. He can steal his IP address, ISP, country name, city name, region, Device info, browser details.<\/p>\n

This vulnerability can be found on the places where you have an option of uploading an image using URL eg. forums, discussion pages, comments sections, messages, fetching image using <img src=\u201dURL\u201d> tag etc.<\/p>\n

How to find this vulnerability ?<\/strong><\/p>\n

    \n
  1. Go to\u00a0https:\/\/iplogger.org\/invisible\/<\/a>\u00a0and generate an invisible image<\/li>\n<\/ol>\n

    2. After that a link will be generated, copy it and click on Logged IP\u2019s<\/p>\n

    \n
    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>

    IP Logger<\/figcaption><\/figure>\n

    3. Now upload the image : 2 ways<\/p>\n

    i) Fetch image using web<\/p>\n

    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>

    Fetching Image – 1<\/figcaption><\/figure>\n

    ii) Fetch image using <img src=\u201dURL\u201d> tag<\/p>\n

    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>

    Fetching Image – 2<\/figcaption><\/figure>\n

    4. Now post it and wait for some time, as soon as people will start looking your topic you\u2019ll get the IP addresses, country name, city name, region, Device info, browser details.<\/p>\n

    \n
    \n
    \n
    \n
    \n
    <\/div>\n

    <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>

    IP and other Info<\/figcaption><\/figure>\n

    Mitigation<\/strong>\u00a0: Proxy all the objects from third-party resources and create a CSP. Although this is only one way of mitigation, their could be many.<\/p>\n

    Thank You \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

    Summary : A vulnerability using which an attacker can obtain the information of all the users without their knowledge. He<\/p>\n","protected":false},"author":1,"featured_media":878,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[51],"tags":[],"yst_prominent_words":[1263,1255,1250,1246,1261,1253,1248,1244,1258,1259,1260,1262,1254,1249,1245,1256,1251,1247,1257,1252],"class_list":["post-877","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials"],"_links":{"self":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/comments?post=877"}],"version-history":[{"count":0,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/posts\/877\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media\/878"}],"wp:attachment":[{"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/media?parent=877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/categories?post=877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/tags?post=877"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https:\/\/zerothcode.com\/blog\/wp-json\/wp\/v2\/yst_prominent_words?post=877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}