# sighook/pixload

Image Payload Creating/Injecting tools

Repository: https://github.com/sighook/pixload
Canonical: https://ross.abutalabs.com/products/pixload
Language: Perl
License: WTFPL
License Family: permissive
Topics: image, payloads, payload-generator, injection, injector, hacking-tool, image-processing, backdoor-attacks, web-attack-payloads
Last push: 2023-11-30T05:14:13+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 2545, "days_push": 1007, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1300, forks 251 (observed 2026-08-28T04:04:17.503838+00:00)

## What it is
pixload is a set of Perl CLI tools for creating and injecting payloads into image files (BMP, GIF, JPG, PNG, WebP). It is used in offensive security testing to craft polyglot images that hide malicious code such as web shells or metasploit payloads.

## Use cases
- inject a web shell payload into a png image
- create polyglot jpeg images to bypass CSP
- hide metasploit payloads inside image files
- test image upload filters for security vulnerabilities
- embed xss payloads in png IDAT chunks
- generate malicious images for penetration testing

## When to choose
- you need to test whether an application's image upload pipeline properly sanitizes files
- you want to craft polyglot image payloads for authorized penetration tests or security research

## When to avoid
- you need general-purpose image editing or conversion
- you are looking for defensive malware analysis tooling rather than offensive payload generation

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, image-processing, penetration-testing
- domain: security, penetration-testing, image-processing
- platform: bsd, cli
- tags: payload-injection, polyglot-files, web-shells, offensive-security, perl, linux, macos, docker

## Member repositories
- sighook/pixload (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:17.503838+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:52:19.802698+00:00, confidence not recorded.
  - readme: https://github.com/sighook/pixload (fetched 2026-08-28T04:04:17.503838+00:00, sha f431e91d5133)
- Data as of 2026-08-30T08:39:29.467469+00:00.