"why not alternative", would be better framed as, "here's a fun variation" — because both approaches are just playing around with technology, for fun / curiosity / exploration. Storing in the pixels is a fun approach, resulting in something Rube Goldberg-esque.
replyHey, yeah, I wrote the article. This (of course) would be more practical. Thanks for pointing it out. I wanted the payload to "live" in actual pixel data rather than hidden text inside an XML file. That’s why I went this way :)
replyIf you wanted to play around and do something a little more challenging (though you'd be bulking up the javascript) then one thing you could do is play with a bespoke html compression. You could store the tags in 4 bits `0001` first bit, tag open or close, and the remaining 3 bits indicate which tag is being used (div/p/b/h1/etc). With at least one of the values like `0111` indicating text is following and another tag like `1111` indicating that an unsupported tag follows.
replyIf you extend it out to 8 bits you can pretty nearly store all the html tags (it'd give you 256 tags to play with).
The ico file format allows multiple resolution icons, so a lot of data
replyGood point, I might add a section in the article where I list alternative approaches. Thanks
replyOr just put the entire website in a <foreignObject> and render it in the favicon.
replyRegular expressions? Ugh. Encode it properly as XML in the correct namespace, load it so, and take it from that.
replyOr just serve the SVG file and use <foreignObject> to embed the HTML, and include <link rel="icon" href=""> inside it. In theory you should be able to define a <view id="icon"> and use <link rel="icon" href="#icon">, but in practice neither Firefox nor Chromium seems to be handling that properly in a favicon, which is disappointing.
lol
replyIt's a hack. A one-liner. Go crazy with it. Or touch grass ;-)
replyOh yeah and favicon isn't part of the DOM.
Just because it's my windmill to tilt at: `[\s\S]` can be written shorter and more precisely as `[^]`.
reply[\s\S] vs. [^]
replyA quixotic windmill tilt if ever I saw one.
ai says [^] is not portable; I did not test it. Too bad, I'll stick to [\s\S].
replyToo bad, indeed. It's well-defined in javascript (and thus, appropriate in this admittedly niche context). It's non-portable across different regex engines, yes.
replyAn SVG can embed raster images: base64 encoded bytes.
replySo you could layer this experiment: favicon is svg, that contains encoded raster, whose bytes are encoded html.
At the very least it would make a mindboggling CTF step.