Collaborate Disseminate
I’m trying to exploit a LFI bug. My link looks like this:
http://example.com/challenge/mypage.php?page=test
When I put /etc/passwd instead of test it shows me:
Warning: include() [function.include]: Failed opening
‘/… Continue reading Exploit LFI bug when a ".inc.php" is appended to the file name?
I was just studying about the XML external entities attack and Remote File Inclusion Attack.
According to my understanding, the XML external entities attack is where the XML parser in the web application has the option of e… Continue reading Difference between XML external entities and Remote File Inclusion attacks
The following function is used to protect from arbitrary file download:-
function file_download($file_name, $file_path) {
$allowedExtensions = array(
“csv”
);
$checkFileName = explode(DIRECTOR… Continue reading File inclusion check bypass
The following function is used to protect from arbitrary file download:-
function file_download($file_name, $file_path) {
$allowedExtensions = array(
“csv”
);
$checkFileName = explode(DIRECTOR… Continue reading File inclusion check bypass
recently I wrote this code:
<?php
$path = ‘../data/about.html’;
$handle = fopen($path, ‘w’) or die(‘Cannot open file: ‘. $path);
$data = $_POST[‘name’];
fwrite($handle, $data);
fclose($handle);
header(“Location: warning… Continue reading Prevent injection on PHP file
Since JBoss is acting as a middleware – Application Server – I was wondering if it’s still possible to face with File Inclusion attacks.(?) The reason I was wandering so is that in such a case, no request will be directly sen… Continue reading RFI – Is this possible even if you use an Application Server?
Suppose we have code that looks something like this:
<?php include(“includes/”.$_GET[‘param1’].”.php”);?>
Now the above code is vulnerable to LFI. If I pass payload ../../../../etc/passwd%00it works perfect and I get the file.
Ho… Continue reading Local File Inclusion to RCE using PHP File Wrappers
In a pentest, I have found a RFI and the endpoint looks like:
https://xxx.com/file.php?page={localhost/evilcode.txt}
Port 80 isn’t open. 22,443 are only open ports
Now, I am using php reverse shell to connect back to my p… Continue reading Can’t get a reverse shell on port 80
During a penetration test, I came across an endpoint which lets me include local files and I can read /etc/passwd. However I don’t have permissions to read proc/self/environ and /etc/shadow.
The endpoint looks like:
http://… Continue reading LFI to RCE when log file isn’t readable