Embedding XSS in an image

Ok, I have been wondering how people do this. Ive tried hex editting, using photoshop to hide a script behind a layer, and even looking at videos. not even google has helped me. Anyone know how to approach this or know how to do it? Its to test the security on a my friends website and I want to make a custom image that does this.

Bl4ckC4t

Rebirth wrote: Note pad, that is all there is to it.

Notepad doesnt create images.

http://ha.ckers.org/xss.html

hex editor would work, I think note pad might work but note pd doesnt display all characters.

i dont think that you are literally supposed to put the javascript into the pictrure coding itself. all you have to do is <img src="javascript:alert('xss')"> i am pretty sure.

chislam wrote: i dont think that you are literally supposed to put the javascript into the pictrure coding itself. all you have to do is <img src="javascript:alert('xss')"> i am pretty sure.

its used to trick people into clicking on an image link, then it sends their cookies to another site..

gdam double post

are you willing to share your code?

been reasearching for a long while now..

http://milw0rm.com/video/watch.php?id=26 doesnt work, either does http://ha.ckers.org/xss.html.. and its like the first time google hasnt helped me