what does 'b.jpg?xxxx' mean? is it a jpg or a script?

[leo.hou]

Dear experts,

I came across the following script in a htm file. Could some one
explain why is it passing some parameter to a jpg file? What does it
mean?

Thanks

<script language="JavaScript" type="text/javascript">
<!--
var r=Math.random();
document.write("<img alt=\"\" width=\"1\" height=\"1\"
style=\"display:none\" ");

document.write("src=\"http://tracking.xxxx.com/b.jpg?cD0yJnU9ey9jbHViLmNoaW5hLmFsaWJhYmEuY29tL2h0 bWwvcGFnZS9jaGF0Lmh0bWx9Jm09e0dFVH0mcz17MjAwfSZyPX todHRwOi8vY2hhdDEuaW5mby5jaGluYS5hbGliYWJhLmNvbS8w MS9saXZlX3RvcC5odG1sfSZhPXstfSZiPXtjX2Nfc2lnbmVkPU 59JmM9ey19&rand="+r+"\">");
-->
</script>
Leo

[leo.hou]

I downloaded this b.jpg file (using flashget) and ultraedit shows the
following. (acdsee views it as a blank image). Could some one explain
what's going on? Thanks!
00000000h: FF D8 FF E0 00 10 4A 46 49 46 00 01 01 00 00 01 ;
??.JFIF......
00000010h: 00 01 00 00 FF FE 00 3E 43 52 45 41 54 4F 52 3A ;
.....?>CREATOR:
00000020h: 20 67 64 2D 6A 70 65 67 20 76 32 2E 30 20 28 75 ; gd-jpeg
v2.0 (u
00000030h: 73 69 6E 67 20 49 4A 47 20 4A 50 45 47 20 76 36 ; sing IJG
JPEG v6
00000040h: 32 29 2C 20 64 65 66 61 75 6C 74 20 71 75 61 6C ; 2),
default qual
00000050h: 69 74 79 0A FF DB 00 43 00 08 06 06 07 06 05 08 ;
ity.?C........
00000060h: 07 07 07 09 09 08 0A 0C 14 0D 0C 0B 0B 0C 19 12 ;
.................
00000070h: 13 0F 14 1D 1A 1F 1E 1D 1A 1C 1C 20 24 2E 27 20 ;
............ $.'
00000080h: 22 2C 23 1C 1C 28 37 29 2C 30 31 34 34 34 1F 27 ;
",#..(7),01444.'
00000090h: 39 3D 38 32 3C 2E 33 34 32 FF DB 00 43 01 09 09 ;
9=82<.342?C...
000000a0h: 09 0C 0B 0C 18 0D 0D 18 32 21 1C 21 32 32 32 32 ;
.........2!.!2222
000000b0h: 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ;
2222222222222222
000000c0h: 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ;
2222222222222222
000000d0h: 32 32 32 32 32 32 32 32 32 32 32 32 32 32 FF C0 ;
22222222222222?
000000e0h: 00 11 08 00 01 00 01 03 01 22 00 02 11 01 03 11 ;
.........."......
000000f0h: 01 FF C4 00 1F 00 00 01 05 01 01 01 01 01 01 00 ;
..?............
00000100h: 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 ;
.................
00000110h: 0A 0B FF C4 00 B5 10 00 02 01 03 03 02 04 03 05 ;
...??.........
00000120h: 05 04 04 00 00 01 7D 01 02 03 00 04 11 05 12 21 ;
.......}........!
00000130h: 31 41 06 13 51 61 07 22 71 14 32 81 91 A1 08 23 ;
1A..Qa."q.2亼?#
00000140h: 42 B1 C1 15 52 D1 F0 24 33 62 72 82 09 0A 16 17 ;
B绷.R佯$3br?...
00000150h: 18 19 1A 25 26 27 28 29 2A 34 35 36 37 38 39 3A ;
....%&'()*456789:
00000160h: 43 44 45 46 47 48 49 4A 53 54 55 56 57 58 59 5A ;
CDEFGHIJSTUVWXYZ
00000170h: 63 64 65 66 67 68 69 6A 73 74 75 76 77 78 79 7A ;
cdefghijstuvwxyz
00000180h: 83 84 85 86 87 88 89 8A 92 93 94 95 96 97 98 99 ;
儎厗噲墛挀敃枟槞
00000190h: 9A A2 A3 A4 A5 A6 A7 A8 A9 AA B2 B3 B4 B5 B6 B7 ;
殺￥ウЖ┆渤�斗
000001a0h: B8 B9 BA C2 C3 C4 C5 C6 C7 C8 C9 CA D2 D3 D4 D5 ;
腹�媚牌侨墒矣哉
000001b0h: D6 D7 D8 D9 DA E1 E2 E3 E4 E5 E6 E7 E8 E9 EA F1 ;
è‚¿åˆ*å�ºå¿�溴éª�æ*�犟
000001c0h: F2 F3 F4 F5 F6 F7 F8 F9 FA FF C4 00 1F 01 00 03 ;
�趱鲼??....
000001d0h: 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 ;
.................
000001e0h: 02 03 04 05 06 07 08 09 0A 0B FF C4 00 B5 11 00 ;
...........??.
000001f0h: 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 ;
...............w.
00000200h: 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 ;
.......!1..AQ.aq.
00000210h: 22 32 81 08 14 42 91 A1 B1 C1 09 23 33 52 F0 15 ;
"2?.B憽绷.#3R?
00000220h: 62 72 D1 0A 16 24 34 E1 25 F1 17 18 19 1A 26 27 ;
br?.$4??...&'
00000230h: 28 29 2A 35 36 37 38 39 3A 43 44 45 46 47 48 49 ;
()*56789:CDEFGHI
00000240h: 4A 53 54 55 56 57 58 59 5A 63 64 65 66 67 68 69 ;
JSTUVWXYZcdefghi
00000250h: 6A 73 74 75 76 77 78 79 7A 82 83 84 85 86 87 88 ;
jstuvwxyz們å‰*唶?
00000260h: 89 8A 92 93 94 95 96 97 98 99 9A A2 A3 A4 A5 A6 ;
墛挀敃枟槞殺￥ウ
00000270h: A7 A8 A9 AA B2 B3 B4 B5 B6 B7 B8 B9 BA C2 C3 C4 ;
Ж┆渤�斗腹�媚
00000280h: C5 C6 C7 C8 C9 CA D2 D3 D4 D5 D6 D7 D8 D9 DA E2 ;
牌侨墒矣哉肿åˆ*é˜�
00000290h: E3 E4 E5 E6 E7 E8 E9 EA F2 F3 F4 F5 F6 F7 F8 F9 ;
沅�玷殛�趱鲼
000002a0h: FA FF DA 00 0C 03 01 00 02 11 03 11 00 3F 00 F9 ;
??.........?.?
000002b0h: FE 8A 28 A0 0F FF D9 ; (?
le*****@gmail.com wrote:

Dear experts,

I came across the following script in a htm file. Could some one
explain why is it passing some parameter to a jpg file? What does it
mean?

Thanks

<script language="JavaScript" type="text/javascript">
<!--
var r=Math.random();
document.write("<img alt=\"\" width=\"1\" height=\"1\"
style=\"display:none\" ");

document.write("src=\"http://tracking.xxxx.com/b.jpg?cD0yJnU9ey9jbHViLmNoaW5hLmFsaWJhYmEuY29tL2h0 bWwvcGFnZS9jaGF0Lmh0bWx9Jm09e0dFVH0mcz17MjAwfSZyPX todHRwOi8vY2hhdDEuaW5mby5jaGluYS5hbGliYWJhLmNvbS8w MS9saXZlX3RvcC5odG1sfSZhPXstfSZiPXtjX2Nfc2lnbmVkPU 59JmM9ey19&rand="+r+"\">");
-->
</script>
Leo

[Tom Cole]

le*****@gmail.com wrote:

Dear experts,

I came across the following script in a htm file. Could some one
explain why is it passing some parameter to a jpg file? What does it
mean?

Thanks

<script language="JavaScript" type="text/javascript">
<!--
var r=Math.random();
document.write("<img alt=\"\" width=\"1\" height=\"1\"
style=\"display:none\" ");

document.write("src=\"http://tracking.xxxx.com/b.jpg?cD0yJnU9ey9jbHViLmNoaW5hLmFsaWJhYmEuY29tL2h0 bWwvcGFnZS9jaGF0Lmh0bWx9Jm09e0dFVH0mcz17MjAwfSZyPX todHRwOi8vY2hhdDEuaW5mby5jaGluYS5hbGliYWJhLmNvbS8w MS9saXZlX3RvcC5odG1sfSZhPXstfSZiPXtjX2Nfc2lnbmVkPU 59JmM9ey19&rand="+r+"\">");
-->
</script>

While I can't comment on this particular instance, when I write these,
it points to server side code (in my case servlets) that are generating
the images on the fly (for a captcha, for example).
There is no rule that a resource with an extension .jpg or the src
attribute of an image has to point to an image file, only it should
point to something that returns image data.

HTH.

>
Leo

[Andy Dingley]

le*****@gmail.com wrote:

I came across the following script in a htm file. Could some one
explain why is it passing some parameter to a jpg file?

"tracking.com" is the clue

It's a web bug, a single pixel transparent GIF. There's no need to
involve a script at all, the "query parameter" is just an ID string
that will be extracted from the webserver logs afterwards. The site
hosting the image tracks many 3rd party sites and the identifiers
differ for each.

Of course it could be an image as a static file, or it could be a
server-side script that generates an image as a stream of bytes in the
HTTP response (as many web page counters use). There's simply no way
it's possible to tell - but simplicity suggests a static file.