---- some wireshark's dump samples: POST /upload_api.php HTTP/1.1 Content-Type: multipart/form-data, boundary=B-O-U-N-D-A-R-Y731553141 Content-Length: 21755 User-Agent: ImageShack Toolbar 4.5.7 ([..]) Host: load9.imageshack.us Connection: Keep-Alive Cache-Control: no-cache Cookie: imgshck=[..]; un_cookie=1; latest=img404; flashInstalled=9.0; __qca=[..]; rem_bar=1; nopopunder=1 --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="toolbar" IEImageShackToolbar-4.5.7.69 --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="public" yes --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="xml" newformat --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="tags" uhuhinterestingprivatethings --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="rembar" 1 --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="fileupload"; filename="xp_wallpaper_glass.jpg" Content-Type: image/jpeg Content-Transfer-Encoding: binary [file content] --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="thumbupload"; filename="xp_wallpaper_glass6fa1f1.jpg" Content-Type: image/jpeg Content-Transfer-Encoding: binary [file content] --B-O-U-N-D-A-R-Y731553141 Content-Disposition: form-data; name="class" s --B-O-U-N-D-A-R-Y731553141-- reply: HTTP/1.1 200 OK Connection: close Transfer-Encoding: chunked X-Powered-By: PHP/5.1.2 Set-Cookie: latest=img262; expires=Sun, 18-Jan-2009 07:56:24 GMT; path=/; domain=.imageshack.us Set-Cookie: PHPSESSID=[..]; path=/ Set-Cookie: always_opt=-1; path=/; domain=.imageshack.us Set-Cookie: rem_bar=1; expires=Sun, 18-Jan-2009 07:56:24 GMT; path=/; domain=.imageshack.us Expires: Thu, 19 Nov 1981 08:52:00 GMT Content-type: text/xml Pragma: public Cache-Control: must-revalidate, post-check=0, pre-check=0 Date: Thu, 24 Jan 2008 07:56:25 GMT Server: lighttpd/1.4.8 0 0.0 xpwallpaperglasstq2.jpg xpwallpaperglasstq2.th.jpg 426 320 s 87.11.97.155 http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg <a href="http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg" target="_blank"><img src="http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg" alt="Free Image Hosting at www.ImageShack.us" border="0"/></a> [URL=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][IMG]http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg[/IMG][/URL] [url=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][img=http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg][/url] http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg <a href="http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg" target="_blank"><img src="http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg" alt="Free Image Hosting at www.ImageShack.us" border="0"/></a> [URL=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][IMG]http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg[/IMG][/URL] [url=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][img=http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg][/url] http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg http://img262.imageshack.us/content.php?page=done&l=img262/7959/xpwallpaperglasstq2.jpg with the boot.ini file: POST /upload_api.php HTTP/1.1 Content-Type: multipart/form-data, boundary=B-O-U-N-D-A-R-Y732118720442 Content-Length: 1077 User-Agent: ImageShack Toolbar 4.5.7 (WinNT 5.1 Service Pack 2) Host: load10.imageshack.us Connection: Keep-Alive Cache-Control: no-cache Cookie: imgshck=[..]; un_cookie=1; latest=img214; flashInstalled=9.0; __qca=[..]; rem_bar=1; nopopunder=1; always_opt=-1 --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="toolbar" IEImageShackToolbar-4.5.7.69 --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="public" yes --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="xml" newformat --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="tags" uhuhinterestingprivatethings --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="rembar" 1 --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="fileupload"; filename="boot.ini" Content-Type: application/octet-stream Content-Transfer-Encoding: binary [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" / fastdetect /NoExecute=OptIn --B-O-U-N-D-A-R-Y732118720442 Content-Disposition: form-data; name="class" s --B-O-U-N-D-A-R-Y732118720442-- reply: HTTP/1.1 200 OK Transfer-Encoding: chunked X-Powered-By: PHP/5.1.2 Content-Type: text/xml Set-Cookie: latest=img89; expires=Sun, 18-Jan-2009 07:56:28 GMT; path=/; domain=.imageshack.us Date: Thu, 24 Jan 2008 07:56:28 GMT Server: lighttpd/1.4.18 Wrong file type detected for file boot.ini:application/octet-stream