Video summary
The video demonstrates how to configure a simple web server using BusyBox's built-in HTTPD to generate images on the fly and log client interactions without the user realizing it. By running the server in verbose mode on a non-standard port, the presenter shows that images are dynamically resized rather than randomly loaded from storage. The core technique involves creating a CGI script that outputs an image header followed by binary data, allowing the script to execute background tasks before sending the final image bytes to the browser. This method ensures that the client perceives only a standard image file, while the server simultaneously performs logging operations or other processing in the background.
A primary application of this technique is tracking visitor IP addresses and geolocation data for various purposes, ranging from simple analytics to email verification. The presenter modifies the script to append the client's remote address to a log file, explaining that this variable captures the public IP of the connecting machine unless a proxy or VPN is used. By utilizing external services or shell scripts, one can even determine the city associated with an IP address. This capability is frequently employed by companies to verify if recipients have opened promotional emails; by embedding a tracking image in an email, senders can confirm delivery and engagement without the recipient needing to click any links or interact with HTML content.
Beyond commercial tracking, the video highlights practical uses for individuals, such as verifying whether a text message containing a link has been received. The presenter notes that some messaging apps do not generate image previews automatically, meaning an image is only fetched when the user clicks a link. By hosting this image on a personal server with logging enabled, a sender can instantly know if their message reached its intended destination and was viewed, rather than being lost in transit or ignored. This provides a reliable way to confirm communication success without relying on third-party preview features that might inadvertently reveal read status to the sender.
In conclusion, while generating thumbnails and PDFs are legitimate uses for server-side scripts, the ability to log IP addresses opens the door to significant privacy implications that users should consider. The presenter emphasizes that websites inherently know a visitor's IP address unless they route through a proxy, allowing them to approximate the user's location down to the city level. Although an IP address is not entirely secret, understanding how easily it can be captured and used for tracking encourages more mindful behavior online. The video serves as both an educational guide on server scripting and a cautionary note about the extent of data collection that occurs during routine web browsing and email reading.
Read the full video transcript
Hello and welcome. We're going to pick
up right where we left off in the last
video. So, if you haven't watched that,
watch that uh so you know what's going
on. Uh but here I'm going to start up a
web server using BusyBox. It's built-in
web server HTTPD. Again, we're going to
force it into the foreground. We're
going to say verbose so we get some
output on what's going on. And I'm just
going to use port 7777 cuz port 80 uh
one you need usually extra permissions
to use and I already have Apache running
on that uh port. So, I'm going to start
that up and if I was to go to my web
browser here, I can refresh. You can see
that we have these images that randomly
load. Again, that's not happening.
They're not randomly loading based on
any JavaScript. They're randomly being
generated and resized on the server
side. Uh but today we're going to talk
about some uh bad things. Eh, kind of
bad things that people do or at least
some tracking type things.
Um so, let me also from here, I'm going
to go {forward slash} cgi-bin {forward
slash} thumbs and just do that and it's
going to every time I do this, just give
me that image.
Now, on my web uh on my client here, I'm
going or on my server here, I'm going to
go into our thumbs script. So, again,
we're saying we're telling the web
browser this is an image, what type of
image, a JPEG image. Then we have an
empty uh new line, you need that. Uh
just that's just how HTTP uh protocol
works. Um so now, I want to do whatever
I want. So, as long as I don't output
any text to the screen cuz that would
gargle up our our image, I can have the
script do whatever I want in the
background.
But as far as the client is concerned,
it's just an image. Your web browser
knows nothing different other than it is
an image. So, for example, I can say
date and I can append to a file in the
directory above this, which would be our
home directory but I can put it anywhere
on my system that I have write access
to. I can say image.log, right?
I will save that.
And if I exit out here just to show you
real quick, I'll go into my home
directory, I'll list out here. There's
no
image.log file in here. Let me refresh
this. I still get the image. Again, as
far as my web browser is concerned, as a
client, I can't tell anything is
happening here other than the fact that
I've gotten an image. I can see that
it's in the CGI-bin, so I know a
script's generating it. But as far as I
know, it's just an image. But if I come
in here now, I have this image.log. If I
was to cat out what's in there, it's a
date stamp.
Well, let's go back into
our CGI-bin
thumbs.
And I can do something else here.
Instead of just the date, I can say echo
and then
I can do this just to get some nice
formatting. Now, in the previous video,
we talked about this query string, which
allowed us to grab variables from the
URL. That's a built-in string for our
web server, but there's other built-in
strings, variables that you can use. So,
I can say dollar sign
Let's go ahead and put a colon in here
just to make it look nice. Dollar sign,
and I can say remote_
address or addre- for address.
And what that's going to do do is give
me the client address. So, if I save
that, now I'm connecting through
localhost. That's just a loopback
device. So, if I refresh this, and now I
was to cat out our image.log file, you
can see here it gives my loopback IP
address. But if I was to connect to it
through its IP address, which would use
my actual network card, I've talked
about back devices before.
Uh but if I was to do this, now if I cat
this out, you'll see that it actually
gives my client IP address, which I can
see can be a little confusing since I'm
logging in from the server. So, down
here, this fort machine is another
machine I have on my local network over
on the other side of the room, and I'm
just going to wget and grab that image,
which is just our script. And again, so
it did it. If I was to file out that, it
will tell us that that is a JPEG image
and it tells me the size of it, which
540 was what we set the script to output
the longest side as. But, if we were to
come up here and we're to cat out log
out or cat out the log file, you can see
it got my IP address. Now, this is my
local IP address.
But, if I was to connect to this server
from outside my network, it would give
me my public IP address. Uh unless I'm
using a proxy server
uh or a you know, like a a VPN or just
SSHing through another proxy server.
There's different ways to do proxy
servers. But, you can log someone's IP
address and not that you can do a whole
lot with someone's IP address,
but again, if they're not using a proxy
of some sort, I can tell within a couple
of miles where you're connecting from.
Or at least what city you're in, which
could be useful. Again, you just take
someone's public IP address, you can
search on Google
uh geolocation IP address and put it in
there. But, there's also services you
can grab them with scripts. So, I could
write a script a shell script here that
when someone connects, not only does it
give me their IP address, but it will
give me the city that they are currently
in. And you can learn a lot from that.
And they do this on websites tracked,
but also emails. So, I use um
NeoMutt on my web server, so my web uh
client or my web client my mail client
that I check my email with is not a GUI
interface. So, it doesn't load when I
look at it, it shows the text, not
necessarily all the HTML. I have a few
keys I press and it'll actually generate
the HTML and load it up in a temporary
file for me to view.
Um but, I had some company that I
actually do business with. I don't
remember if it was a bank or a credit
card company
or like my ISP or something, but I got
an email from them once saying, "We've
noticed you haven't opened one of our
emails in 6 months. We just want to make
sure this is still your email address."
And it's funny cuz I did open up all
their emails,
but I I didn't load the HTML. I just
looked at the text of the file. So, they
were clearly doing something like this
to at the very least know that I've
opened the email. So, I could send
somebody um
in an email a link to this. I could send
somebody obviously with uh port
forwarding to my actual IP address or if
I have a um domain registered. But, once
I have my web server set set up, I can
point someone to this. I can send them a
text. And the second they look at that
image or if their text client uh
automatically looks at the thumbnail,
you know, it if it if it reads it, I
know that text got to them. Right? Uh
same with emails. I know that you've
received and most likely opened my email
based on the script. I could have it
send me alerts. So, I could send you the
URL to this script. You look at it,
looks like an image, and right away I
get a text or some or sort of message on
my phone or desktop saying, "So-and-so
opened the file. Here's their IP
address. They're in this city."
Now, that's a whole lot of information,
but it's a start, and it is something
that is done by companies, especially in
emails when they're tracking you, just
to see, "Oh, did they open this email?
Were they interested in this email?"
Um
and that sort of stuff. So, just
something to think about. There are
legit reasons for having scripts, again,
resizing thumbnails and stuff, uh or
generating PDFs, as I said last uh
video, can be useful. Uh but, it could
also be used in somewhat suspicious
ways.
Uh again, not that your IP address is
super secret. You don't need to run a
VPN on everything you do, uh but when
you go to a website, they do know your
IP address unless you're going through a
proxy of some sort. And with that, they
at at the very least can tell what city
you're in.
So, something to think about. Uh
and yeah.
Just a little informative video here, a
little add-on to our last video, which
was useful stuff, but also something
here that Again, this is a a great way
If someone's not returning your texts,
uh Uh, you could send them an image, a
link to an image, and
now, depending on what uh, they're like,
I use QKSMS, which is an open source um,
text
text message application.
It does not give me previews of images
and stuff. I'd have to click on a link
to view an image that is sent as a link.
Obviously, if they send me uh, a media
message with an image, I can view that.
But, if they send me a link, it doesn't
generate for any websites previews.
It'd be kind of nice if it did, but at
the same time the second it does that
they they that whoever sent me that
could know that I have received the
text. So, you could if someone's not
responding to your text, you could do
this and know that it's at least getting
them unless you're sending it to the
wrong person and someone else is getting
it and ignoring you and like you have
the wrong phone number.
But, you know it's getting somewhere if
the image is viewed. So, it's not just
getting lost in space. So, think about
that.
Uh, I'll put a link in the description
to this script or at least the script
from the last video. Again, the only
thing we added here
is uh, we use this variable right here,
which is part of BusyBox's, uh, but you
can do the same thing with PHP code on
um, Apache servers. I did a video on
that recently. Uh, but we're we're just
getting the date and their IP address
and we're putting it into a log file.
Uh, other than that, this is the same
script from the last video.
Uh, I hope that you have a great day. I
thank you for watching. Please visit
filmsbychris.com. I have a Patreon page,
all that stuff. Appreciate you sticking
around. If you like this type of video,
let me know in the comments below. If
you have any questions, let me know in
the comments below. And as always, I
hope that you have a great day.