I am initiating and doing a basic penetration testing course and have come across one doubt.
For example in this URL:
http://webapp.thm/index.php=?page=1http://webapp.thm/index.php=?page=1
I get that I am requesting the index.phpindex.php
file in the server and I am specifying that I want to view page 1 as a value of the parameter page.
But in this other URL: http://webapp.thm/get.php?file=/etc/passwdhttp://webapp.thm/get.php?file=/etc/passwd
I am having trouble understanding this request because I am requesting get.phpget.php
(which is already a file) and the parameter "file"file
is accesing a different file /etc/passwd/etc/passwd
.
My question is what does the get.phpget.php
file contain in this case or is it a function? because it seems to me that it is function retrieving the /etc/passwd/etc/passwd
, but I know that it is not a function, so I am kind of confused about what could the getget.php
means.php mean, here I
got a picture describing it from the course :