# Event Loop Blocking + Lazy images

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.** * **Share your hacking tricks by submitting PRs to the [hacktricks repo](https://github.com/carlospolop/hacktricks) and [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.

In [**this exploit**](https://gist.github.com/aszx87410/155f8110e667bae3d10a36862870ba45), [**@aszx87410**](https://twitter.com/aszx87410) mixes the **lazy image side channel** technique through a HTML injection with kind of **event loop blocking technique** to leak chars. This is a **different exploit for the CTF chall** that was already commented in the following page. take a look for more info about the challenge: {% content-ref url="connection-pool-example.md" %} [connection-pool-example.md](connection-pool-example.md) {% endcontent-ref %} The idea behind this exploit is: * The posts are loaded alphabetically * An **attacker** can **inject** a **post** starting with **"A"**, then some **HTML tag** (like a big **` ```

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!