You can see this in action for yourself on a unix cli: $ curl -o squirrel.html http://lcamtuf.coredump.cx/squirrel/ $ file squirrel.html squirrel.html: JPEG image data, JFIF standard 1.01, comment: " body { visibility: hidden; } .n { visibilit" Open the file in a browser and read the page. Then: $ mv squirrel.html squirrel.jpg Open the renamed file in a browser and only the image appears. I'm not sure what the securi…
[0]: http://binwalk.org/