Metadata-Attacker

Metadata-Attacker 通过这套小型开源渗透测试工具，您可以创建包含自定义元数据或一组跨站脚本向量的图像（.jpg）、音频（.mp3）或视频（.mp4）文件，用于测试任何 Web 服务在显示未过滤元数据时可能存在的 XSS 漏洞。 安装 / 使用 首先在您的宿主机上安装 docker。 现在您可以运行以下命令： sudo docker run -p 80:80 --rm lednerb/metadata-attacker 完成后，打开您喜欢的浏览器并访问 docker IP 或 http://localhost 致谢 影像攻击器由 @mniemietz 开发 音频攻击器由...

GHSA-9Q4R-X2HJ-JMVR copyparty has DOM-Based XSS vulnerability when displaying multimedia metadata

Summary An unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. Details Multimedia metadata is rendered in the web-app without sanitization. This can be exploited in two way...

Metadata-Attacker - A Tool To Generate Media Files With Malicious Metadata

With this small suite of open source pentesting tools you're able to create an image .jpg, audio .mp3 or video .mp4 file containing your custom metadata or a set of cross-site scripting vectors to test any webservice against possible XSS vulnerabilities when displaying unfiltered meta data...