Tag Info

Hot answers tagged

3

Generally if you're looking to test for RFI the way to approach it is to place a URL that you have control over as the parameter. That way then the URL is accessed you can look in the web server logs to see if you had a request from the server your assessing for that page. As to whether this website is vulnerable, to be honest it's not possible to tell ...


3

On Solaris, you get a process environment with these commands: pargs $$ pargs -e $$ There is no shortcut like /proc/self with Solaris so you need to know the PID of the process, eg.: /proc/$$/psinfo Moreover, only the arguments are visible here, the environment is in /proc/pid/as and I doubt this file to be exploitable with LFI as it is kind of a ...


3

Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area. Wikipedia says: Carpet bombing is a large aerial bombing done in a progressive manner to inflict damage in every part of a selected area of land. The phrase evokes the image of explosions ...


2

I believe you also need to include in the php.ini the directive of: allow_url_fopen to be set to 1 This allows remote URLs to be loaded using fopen, but considering you're not using fopen, I guess it's not really applicable, but worth a try none the less. You could also try register_globals this variable controls whether arbitrary variables can be injected ...


2

It can be exploited by log files injection. it might be possible to inject Apache log files, but these files needs root access to open, so it will not be possible to open them via LFI. to solve this problem, we inject temporary Apache log files, which are existed under this path: proc/self/fd/12 or proc/self/fd/14 or proc/<apachi pid>/fd/12 or ...


1

XSS is an attack against the client, not the server. The only way an attacker could turn this against the server is if the victim has special privileges (like an administrator account).


1

Null Byte Poisoning is pretty old vulnerability, which has been already fixed since 5.3.4 PHP-version. Release Announcement: Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). If you are sure, that your PHP-version is correct, please try to inject some remote resource without NULL-byte character in path, to check, if ...


1

You should read LFI to RCE. You need to be able to upload a file or populate a log file with a PHP tag and then include this file using the LFI vulnerability.



Only top voted, non community-wiki answers of a minimum length are eligible