stealthing
==========

or: hiding files from browsers
==============================


  


The above is a picture which consists of 2 files.

it has been composed by

cat cross.gif not.gif > both.gif



save it as both.gif.

then, strip the first 10783 bytes from this file, e.g.

dd if=both.gif bs=1 skip=10783 of=what.gif

and view what.gif with your favorite image viewer.

==================================================================

I never found the string XXXXXXXX in a gif, so you may stealth
many files as follows:

gif-file XXXXXXXX filename1 XXXXXXXX file1 XXXXXXXX filename2 ...
and so on.

===================================================================

heres another picture, which carries a whole pdf with it:



save it, seek for the XXXXXXXX, and rebuild the pdf. X is 58 in hex.

on my linux system, i viewed it with

hexdump smiley2.gif | less

and, after seeking 5858 with

/5858

found that the second file begins at 0x72, thats 7*16+2 = 114 in
decimal.

i extracted it with

dd if=smiley2.gif bs=1 skip=144 of=p.pdf

and - voila - got my pdf file.

===================================================================

so theres much potential for winzip.gif, portableopenoffice.gif,

dancingqueen.gif etc out there...

remember that on free homepage servers, theres often a file length
limit of 1 megabyte.

and sometimes they slow down the download after 300 kbyte.

==================================================================

end of document