If you send the url https://gbasil.dev/uwu.png in Discord, you'll be greeted with an inconspicuous image of Rick Astley prompting you to open the image in your web browser. IF you follow through, you'll be greeted with a classical rickroll.
How it Worx™️
uwu.png is simply an express.js endpoint, not an actual png file. When you post a link in Discord, a request is send with the user agent of Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)
. If Discord confirm that it is an image, another request is issued to grab the image, this time with the user agent being Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0
. This is the code I wrote:
app.get("/uwu.png", (req, res) => {
if (req.get('User-Agent').includes("discord") || req.get('User-Agent').includes("Firefox/38.0")) {
res.sendFile(path.join(__dirname, "public/img/rick.png"));
} else {
res.redirect("https://youtube.com/watch?v=dQw4w9WgXcQ");
}
});