How does it run ?

[minanagehsalalma]

The output files .. What happens when you click on them ?

[iosdec]

@minanagehsalalma

[minanagehsalalma]

@iosdec ohh.. Thanks

[sighook]

Useful references:

• Bypassing CSP using polyglot JPEGs

• Hacking group using Polyglot images to hide malvertising attacks

• Encoding Web Shells in PNG IDAT chunks

• An XSS on Facebook via PNGs & Wonky Content Types

• Revisiting XSS payloads in PNG IDAT chunks