圖片是現今大多數的網站上不可或缺的一項元素，對於文字無法 說明的部分，圖片是一種能夠輔助說明的媒介，在任何能夠讓使用 者交流的網站，大多都允許使用者發布圖片，這就具有被駭客利在 在網路攻擊上的可能性。因其廣泛性與重要性，許多網站都不會去 禁止 img tag 的使用，使得基於圖片的多用途網際網路郵件擴展類 型混淆攻擊(Multipurpose Internet Mail Extensions(MIME) Type Confusion attack)變得相當重要。 多用途網際網路郵件擴展類型混淆攻擊是駭客利用瀏覽器會使用 MIME-Type sniffing 檢測正確的檔案類型這一特徵，而發展出來的 攻擊。早期的瀏覽器開始導入 MIME-Type sniffing 功能的原因， 是用來防止伺服器給出錯誤的檔案格式，而讓瀏覽器使用錯誤的處 理方式解釋接收到的資源。而這卻被駭客利用偽裝檔案類型的方 式，讓瀏覽器在未經使用者同意的情況下導致跨網站腳本攻擊 (Coss-Site Scripting(XSS) attack)。或者使用者的個人訊息透過 惡意的網絡信標(Web Beacon)，導致使用者的隱私遭到洩漏。
本論文提出一種方法，針對任何應當是圖片類型的資源，在瀏覽 器向伺服器請求資源之前，就正確的辨認和解釋會從伺服器傳遞的 檔案類型，並透過實作成瀏覽器插件的形式，以即時動態分析的方 式，預先阻擋任何可疑的請求，以阻斷 MIME Type Confusion attack 的攻擊途徑。;Images are an indispensable element on most websites today. For parts that cannot be explained by text, pictures are a medium that can assist in explanation. Most of the websites that allow users to communicate, allow users to post pictures. This has the possibility of being exploited by hackers in attacks. Because of its extensiveness and importance, many websites will not prohibit the use of img tag, making image-based Multipurpose Internet Mail Extensions (MIME) Type Confusion attack (Multipurpose Internet Mail Extensions (MIME) Type Confusion attack) very important. The MIME type confusion attack is an attack developed by hackers to take advantage of the fact that browsers use MIME sniffing to detect the correct file type. The reason why early browsers started importing MIME-Type sniffing was to prevent the server from giving the wrong file format and let the browser interpret the received resource in the wrong way. However, hackers use the method of disguising the file type to allow the browser to cause a cross-site scripting attack (Coss-Site Scripting (XSS) attack) without the consent of the user. Forgery (CSRF) attack). Or the user′s personal information is transmitted through a malicious web beacon (Web Beacon), causing the user′s privacy to be leaked. This paper proposes a method to correctly identify and explain the file type that will be transmitted from the server before the browser requests the resource from the server for any resource that should be an image type, and implement it in the form of a browser plug-in. By means of real-time dynamic analysis, any suspicious request is blocked in advance to block the attack path of MIME Type Confusion attack.
