I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article?

I'm a newbie about these type of topics. I want to be a pentester. So all your answers is very improtent for me. Thanks for help.

P.S: When i'm searching web, i found this. But this isn't work. http://php.webtutor.pl/en/2011/05/13/php-code-injection-a-simple-virus-written-in-php-and-carried-in-a-jpeg-image/


Passing the malicious code as an image largely relies on how does the targeted website check file uploads. If the website is checking the extension only, so it's looking for .jpg in your file name, a simple bypass is .jpg.php file, for instance. If the website is checking headers only, you make sure your PHP script is throwing headers that make it appear as if it was an image file. You wanna do a google search for "mask php as jpg" or "php shell jpg" for more information.

As for windows, not much too it, there's a few still working ways, but you'll have a semi-hard time getting your target to open the files. For example, you can change your .exe file to a .jpg file and create another shortcut file in the same folder. As target for the shortcut, you'd put C:WINDOWSsystem32cmd.exe /c whateverexeyourenamed.jpg. Clicking the shortuct would, in turn, execute the .jpg file as .exe, however, this method is pretty ancient and my grandma, if she were alive, would be able to see it.

Since you stated you want to be a pentester, my best advice is mess with it. Host a php server or whatever it is you're trying to breach, add a nice file upload protection and try to breach it. If by "javascript injection" you mean "xss attack", that's carried a bit differently, and has nothing to do with the images, if you google the term, I'm pretty sure you'll get it. If by "javascript injection" you mean that you show an image to the user on the website, that will do damage to them if they click it (simple `" element, sure, but maximum you'd be able to do is get them to like a random facebook page or something useless along the lines. And finally, if by "javascript injection" you mean making a page that will prompt users for something and drop a shell on their computer, possible, tricky, and very hard to pull of, considering the level of intelligence and awareness of your targets has to be incredibly low.

Stuff to check out (type it in google):

  1. File upload vulnerabilities PHP
  2. XSS attacks
  3. Javascript injection
  4. Man in the middle attack

Sorry if I missed your questions, but this is the best answer I can give you considering your question. If you're looking for something specific, you might want to highlight it.

  • This answer is great for me. Now i know, how to do. Thanks for sharing. – Osman Ercelik Jan 28 '14 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.