mkdir -p ~/tmp/squirrel cd ~/tmp/squirrel wget -O index.htm http://lcamtuf.coredump.cx/squirrel/ http://lcamtuf.coredump.cx/squirrel/ firefox index.htm Alte

mkdir -p ~/tmp/squirrel cd ~/tmp/squirrel wget -O index.htm http://lcamtuf.coredump.cx/squirrel/ http://lcamtuf.coredump.cx/squirrel/ firefox index.htm Alternately, using an actual webserver instead of opening a file:// python3 -m http.server & firefox http://127.0.0.1:8000/ http://127.0.0.1:8000/ Also works. Note that the actual img tag has src="#" so when you are looking at the file opened locally, the image is also from local disk, not from his server, so it's legit. However, the fact that it needs to be identified as a HTML file by the server implies to me that the idea others had ITT of abusing image hosting sites using this trick probably won't work.