4 ms·
Your background-image url must be an endpoint that can process a request. Simply, requesting a placehold.it/a image is pointless, but sending to l33thacker.com/
by maxchehab 9y ago
Your background-image url must be an endpoint that can process a request. Simply, requesting a placehold.it/a image is pointless, but sending to l33thacker.com/a, assuming that l33thacker.com knows how to process that request maliciously, will work.
- Raphmedia 9y agoBut you would still see the network call to placehold.it/ if it actually worked.
- ficklepickle 9y agoIt can be done manually. Send the request to a server you control and check the logs. It doesn't scale well but it would work fine for a targeted attack.