@lolipop™ I thought of a great example of the sort of thing Python is great for. Like most forums, users can have a custom signature that shows up on their posts. If you take a look at the signature editor you'll see that you can select an image by a link to have show up as your signature:
a valid image type you could link to is an SVG image (Scalable Vector Graphics). SVG images are interesting because they're really just a markup language like XML or HTML. Even if it's rendered as a .svg file, you can open it up with a text editor and see how it's made. They're usually intended to be used as lightweight assets and pallets for a website or graphical environment, but we can get really creative with them. Here is a rough little python flask server that will generate a signature image that has some random text in it:
Python:
import cairo
import random
import string
from flask import Flask
app = Flask(__name__)
def random_string():
return "".join(random.choice(string.ascii_letters) for _ in range(20))
def render_svg(text: str):
# 600x100 is considered a "typical" modern signature size
with cairo.SVGSurface("tmp.svg", 600, 100) as signature:
context = cairo.Context(signature)
context.set_font_size(12)
context.move_to(50,50)
context.show_text(text)
context.stroke()
@app.route("/signature.svg")
def signature():
render_svg(random_string())
with open("tmp.svg", "r") as f:
img = f.read()
return img
if you put this into a file called
main.py
you can run it with:
flask --app main run
(assuming have python and pip installed, and have installed flask and pycairo with pip). I can try it out:
this one is a really basic example, but you could change it to be way cooler. you could take an image you like, and overlay text over it, create geometric shapes, etc. In this example you could easily add in a library like `fortune` to replace the random text with actual quotes, or just serve quotes you like out of a file.
an interesting aside, a lot of websites will try to inspect media files when they're uploaded, to figure out what to do with them. There are certain systems out there (like old versions of ImageMagick) that would accidentally run code that had been embedded into SVG files. You could write a reverse shell, embed it in an svg file, upload it to a website, and then viola you are logged in as the system httpd/nginx/etc user!