Tag Info

Hot answers tagged

4

The presented mitigation is absolutely insufficient. It’s not just possible to include any file from the current directory but also from any directory depending on the file system (i. e., \.. still works on Windows) or by using an absolute path (e. g., /… on Unix-like systems, or \… on Windows) as well via different protocols/wrappers (e. g., http://…, ...


3

This is most likely a botnet trying the "doors" as Bob has suggested. From time-to-time, vulnerabilities appear in standard software that allows attackers access via supposedly innocuous entry points. If you don't already have it installed, I would recommend something like fail2ban which will automatically ban source IP's that make attempts to get to ...


3

It can be exploited by log files injection. it might be possible to inject Apache log files, but these files needs root access to open, so it will not be possible to open them via LFI. to solve this problem, we inject temporary Apache log files, which are existed under this path: proc/self/fd/12 or proc/self/fd/14 or proc/<apachi pid>/fd/12 or ...


3

Generally if you're looking to test for RFI the way to approach it is to place a URL that you have control over as the parameter. That way then the URL is accessed you can look in the web server logs to see if you had a request from the server your assessing for that page. As to whether this website is vulnerable, to be honest it's not possible to tell ...


3

On Solaris, you get a process environment with these commands: pargs $$ pargs -e $$ There is no shortcut like /proc/self with Solaris so you need to know the PID of the process, eg.: /proc/$$/psinfo Moreover, only the arguments are visible here, the environment is in /proc/pid/as and I doubt this file to be exploitable with LFI as it is kind of a ...


3

Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area. Wikipedia says: Carpet bombing is a large aerial bombing done in a progressive manner to inflict damage in every part of a selected area of land. The phrase evokes the image of explosions ...


2

Null Byte Poisoning is pretty old vulnerability, which has been already fixed since 5.3.4 PHP-version. Release Announcement: Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243). If you are sure, that your PHP-version is correct, please try to inject some remote resource without NULL-byte character in path, to check, if ...


2

I believe you also need to include in the php.ini the directive of: allow_url_fopen to be set to 1 This allows remote URLs to be loaded using fopen, but considering you're not using fopen, I guess it's not really applicable, but worth a try none the less. You could also try register_globals this variable controls whether arbitrary variables can be injected ...


1

I don't think this will allow someone to directly include /etc/passwd, but there's still a lot of trouble to be had from this. An attacker might be able to: Trigger a DoS by including the file itself. (Since you're using include, not include_once, it'll recursively keep including the same file.) Include arbitrary scripts on your system, such as copies of ...


1

XSS is an attack against the client, not the server. The only way an attacker could turn this against the server is if the victim has special privileges (like an administrator account).


1

You should read LFI to RCE. You need to be able to upload a file or populate a log file with a PHP tag and then include this file using the LFI vulnerability.



Only top voted, non community-wiki answers of a minimum length are eligible