Gist 055a86617685691db7632fcb10fb8bc8

100%

Gist 055a86617685691db7632fcb10fb8bc8

✓ Published0🌍 Public

Last edited Oct 4, 2018

Created on Oct 4, 2018

This example demonstrates a simulated cross-site scripting (XSS) attack via remote file inclusion, visually rendering a PHP script’s output as an alert dialog that exposes `document.cookie`. The visualization uses a plain HTML page to embed the PHP snippet, with the code directly echoing a `<script>` tag that triggers the alert. It relies on the browser’s native JavaScript execution rather than external libraries, showing the raw mechanism of injecting client-side code through a server-side include. The rendering approach is minimal, presenting the source code and its resulting runtime behavior side by side.

AI-generated description

Similar vizzes

Loading thumbnail…

Gist 6caf9fb33f0b7bf1fe0b594b403dc053

This example demonstrates a potential security exploit rather than a data visualization. The PHP code generates an HTML script tag that uses JavaScript to send the visitor’s cookies to a remote webhook URL via an img request. It relies on the `document.cookie` API to capture cookie data and the `document.write` method to inject the tracking pixel. The rendering approach is purely client-side, with no charting or visualization libraries involved. The piece highlights how insecure code can misuse basic web technologies for data exfiltration.

PPeleke

81% match

Loading thumbnail…

Gist 6ed3f84640838d8320f6b209b1628e41

This example demonstrates a cross-site scripting (XSS) proof-of-concept that exfiltrates a visitor’s cookies. The code uses a raw JavaScript payload with `document.write` to inject an `<img>` tag, which fires a request to a user-supplied Ngrok URL, appending `document.cookie` as a query parameter. It shows a simple, direct attack vector for testing XSS vulnerabilities, relying on the browser’s automatic image request to send data to an external server. The visualization is the code itself, presented as a threat-modeling sample rather than a chart.

PPeleke

81% match

Loading thumbnail…

Gist 6b1a5d43e458a795e475b14a5d9dbeac

This example demonstrates a malicious PHP file embedded within a GitHub gist, where an `echo` statement outputs `<h3>HACKED</h3>` to the page. The code uses the PHP `echo` language construct to directly inject HTML into the response, simulating a simple cross-site scripting or content injection attack. The gist syntax-highlights the PHP code, showing how a plain text file can carry executable server-side logic. The example highlights the security risk of trusting raw gist content, as the code appears as a static file but would execute if processed by a PHP-enabled server.

PPeleke

78% match

Loading thumbnail…

Gist 1f02b0833eba6f40ff53aff3d6e3a794

This example is a simple PHP script that demonstrates basic echo output. It assigns a multi-line HTML string containing an `<h1>` heading to a variable using the heredoc syntax, and then outputs it with the `echo` statement. The visualization shows the resulting rendered HTML page in the browser. The code relies on PHP's built-in echo construct and standard heredoc string handling rather than any external libraries or data sources.

PPeleke

63% match

Loading thumbnail…

Gist 1b1889baaec2adffe574

This example demonstrates a WordPress theme’s strategy for optimizing CSS delivery by inlining critical styles and asynchronously loading the full stylesheet. It shows how PHP hooks like `wp_head` and `wp_footer` conditionally inject scripts, styles, and a cookie-based cache check. The code uses `file_get_contents` to embed JavaScript files such as `loadCSS.js` and `onloadCSS.js`, alongside a `<style>` block for critical CSS. A `noscript` fallback ensures the full stylesheet loads without JavaScript. The implementation relies on the `Roots\Sage\Assets` namespace and functions like `asset_path()` to resolve file paths.

GGolodhros

62% match

Loading thumbnail…

Gist 124270

This example presents a PHP class, `gist 124270`, which serves as a minimal demonstration of conditional file inclusion. The code defines a class and then checks whether the current file is being executed directly by comparing the `__FILE__` constant to the `SCRIPT_FILENAME` server variable. If the condition is true, the class is instantiated or demonstrated. The visualization itself is not a graphical display; rather, it is a concise, logic-based snippet that shows how to guard against direct execution while allowing the class to be used when the file is loaded as part of a larger script.

SSimonS

61% match

Loading thumbnail…

Gist 7232670

This example demonstrates how a single-page application skeleton is transformed from a static document into an interactive, AJAX-driven experience. The visualization shows a list of user-submitted code entries, with each entry dynamically loaded and rendered without a full page refresh. The implementation uses jQuery’s `$.ajax` method to fetch the `lucky_ajax.md` file and other resources, then updates the DOM with the retrieved content. The code also relies on JavaScript’s `Promise` API for handling asynchronous responses, and highlights the use of `XMLHttpRequest` for network communication. The data source is the downloaded application skeleton, whose structure is revealed through the fetched files. The example focuses on the interaction between client-side scripting and server responses.

EElaineYu

61% match

Loading thumbnail…

Gist 940d9e28b4c94f7fea376c678e767261

This visualization shows a WordPress maintenance-mode message displayed as a stark red alert, blocking site access for unauthorized users. It renders a static HTML page with inline CSS styling via a PHP function, rather than using a JavaScript visualization library. The code checks user capabilities and login status with `current_user_can` and `is_user_logged_in`, then outputs the message using `wp_die` hooked into `get_header`. No data source or rendering framework is involved, as the example relies purely on server-side PHP and browser-rendered HTML.

KKopylovVitalik

59% match