PictureBox

gadget

System.Windows.Forms.PictureBox loads the supplied HTTP, HTTPS, FTP, or file URL through ImageLocation. This can trigger SSRF or NTLM authentication.

Declared metadata, not a runtime result. How to read evidence.

.\ysonet.exe -g PictureBox -h

Target declarations

Variant	Formatters	Inputs	Requirements	Runtime tokens
Default	Json.NET, FastJson, JavaScriptSerializer, YamlDotNet, MessagePackTypeless, MessagePackTypelessLz4, SharpSerializerXml, Xaml	remote-url	built-in, net-framework	net-fx-4.0, net-fx-4.5, net-fx-4.5.1, net-fx-4.5.2, net-fx-4.6, net-fx-4.6.1, net-fx-4.6.2, net-fx-4.7, net-fx-4.7.1, net-fx-4.7.2, net-fx-4.8, net-fx-4.8.1

Options (1)

Option	Help	Default	Required
rawinput	Pass -c verbatim into the payload template instead of escaping it for the selected formatter. Use this only for already-escaped input. Default value: "false".	false	false

Credit: [Finders: Piotr Bazydlo]

All modules · Full catalog JSON