Hiding JS in Valid Images ha.ckers.org web application security labMatteo Carli wrote me today to discuss some RFI and JS stuff. We’ve been talking a lot about what uploaded images can do lately, but embedded JS is an interesting one for a few reasons. If you needed a drop for a payload, for instance. Here’s part of his email (edited slightly for formatting): So i created a simple php test like this: <?php include 'myimage.gif'; ?> and the result is like this. Im
