Waraxe IT Security Portal

robin1200 · Regular user

the above code does not even includes the logout xss, as for the image ..."unicorn.jpg" where are we supposed to upload it to?

Rolling Eyes

lunix · Regular user

I tried this a while ago. I also tried using the GD library to create an image with php.
But because the header sent by the script is a redirect header it wont work because the image will need to send image headers to get displayed.

So the script will be trying to tell the browser to look somewhere else because there is no file there, and then the image will be trying to download.

Its like trying to get a 404 error page that also contains your index.php

by having one it means you cant have the other.
Its a redirect OR an image, cant have both.

Would love to be proved wrong on this, but to the extent of my knowledge its inpossible.

Unicorn · Regular user

Ok, i spent a lot of time thinking and i thought, that maybe the best option is to trick people by making the picture a link....
Maybe anyone can work anything out of this.....

NB! Read my last post

Ahasver · Beginner

Ok, hello guys Im new to yours forum and hope we will have a bunch of communication...(a little bit offtopic)

So, this topic really triggered me and i was wondering was it possible not to execute the logout command, but to do a real cross side script, to redirect the user to another script which will ofcourse have more mallicious code? (Or i just got this all wrong!?)

Greetings.