The source code of level8 is here. <?php $uploadedFile = sprintf('%1$s/%2$s', '/uploads', sha1($_FILES['fileToUpload']['name']) . '.gif'); if (file_exists ($uploadedFile)) { unlink ($uploadedFile); } if ($_FILES['fileToUpload']['size'] <= 50000) { if (getimagesize ($_FILES['fileToUpload']['tmp_name']) !== false) { if (exif_imagetype($_FILES['fileToUpload']['tmp_name']) === IMAGETYPE_GIF) { move_uploaded_file ($_FILES['fileToUpload']['tmp_name'], $uploadedFile); echo '<p class="lead">Dump of <a href="/level08' . $uploadedFile . '">'. htmlentities($_FILES['fileToUpload']['name']) . '</a>:</p>'; echo '<pre>'; include_once($uploadedFile); echo '</pre>'; unlink($uploadedFile); } else { echo '<p class="text-danger">The file is not a GIF</p>'; } } else { echo '<p class="text-danger">The file is not an image</p>'; } } else { echo '<p class="text-danger">The file is too big</p>'; } ?