Executable PHP in a GIF image

Status
Not open for further replies.
i've almost got everything working. the problem now is that i have two commands in the script, but the server will only execute whichever one comes first.

how can i make these two commands execute in sequence?

if (strlen($_SERVER['HTTP_REFERER'])) {
Readfile("/home/username/public_html/demo/file.jpg");
Header("Location: http://www.ebay.com/?affid=123456");
}

tsp
 
Advertise on BHW
here is a nice video for you guys where one speaker of the DefCon conference is speaking about the exact same thing:

hxxp://video.google.com/videoplay?docid=4221457095668033104&q=T312&ei=PQwWSN7hFoqUrgKvkNzyBA
 
The Scarlet Pimp said:
i've almost got everything working. the problem now is that i have two commands in the script, but the server will only execute whichever one comes first.

how can i make these two commands execute in sequence?

if (strlen($_SERVER['HTTP_REFERER'])) {
Readfile("/home/username/public_html/demo/file.jpg");
Header("Location: http://www.ebay.com/?affid=123456");
}

tsp
Click to expand...

Header has to be called before anything that might generate screen output... and Location is a redirect header, which means the user will be pushed away from your script.

In short, it doesn't look like you can.
 
Right. By sending out the image, you've sent out a header saying it's an image, that's the end of the HTTP conversation between client -> server .. Can't do a location then an image, cause uhh the browser is busy going to the Location: ... :D
 
Good video, but not exactly for cookie stuffing. You can only stuff a cookie from the server where that "php" image is located. There was an interesting part in that video though. P3P part.
I've never heard of it before, but from what I understand it allows third-party cookies. I played around with it, but for some reason IE6 and 7 still rejecting third party cookies. Anyone tried it?
 
I was doing this with robots.txt for cloaking but I got caught :D
Robots don't always use this file...
You can rename and execute pretty much every file thanks to this htaccess technique
 
OK, I am bumping an old one here :P

I have heard that you can use XSS inside a GIF file and PHP with a gif but people on this thread are saying that you can force it to read it as a PHP file. By doing this there will be a red X / the image will not load. Is there a way to execute PHP inside a gif and load an image at the same time?
 
Is there a way to execute PHP inside a gif and load an image at the same time?
Click to expand...
It depends what a code is supposed to do - in many cases it is possible.
 
Load a URL / cookie stuffing are my intentions with this. Is this possible?
 
send me on PM what method you want to use and I will give you whether it is possible - if it is possible I will show you how to do that

regards
 
Pryda said:
Afaik, it's impossible. The server only executes PHP scripts when the extension is defined as PHP script. So for this, GIF has to be defined as PHP script. But then it still won't be able to handle a PHP script in the middle of a GIF image, because GIF is binary and PHP isn't.

It is possible to create a PHP script that outputs a GIF image, but that's not what you want, is it? :)
Click to expand...

This IS POSSIBLE, Im not going into detail here as I dont fully know how its done myself, But I know for a fact its possible to do.
 
Advertise on BHW
Status
Not open for further replies.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top