I am doing a CTF image now, and I need to upload a .zip file to execute using the php wrapper zip:// using this PHP ZIP Wrapper LFI vulnerability

The problem is that the only way to upload is with a POST form, so I would like to intercept the POST, submit and change the text I added for the binary data of the zip file.

I have tried to cat the *.zip file and paste it before continuing the POST but it did not work.

Some people suggested using Burp but I would like to know how to do this with Zap proxy.

  • The basic idea in Burp will also work in Zap. – schroeder Feb 6 '18 at 10:05
  • Hello, ok and what is this idea so I can try it on zap? I do not use burp. My idea is to be able to select the file and inject it, I do not see any option on zap for this, (as far I can see), I have try with curl witrh @file but this did not work – cfernandezlinux Feb 6 '18 at 15:25

Ok well is not exactly what I wanted but in zap if you go to the url with the form.. then intercept and instead of injecting I was able to select the post, then use one of the build in scripts in ZAP to convert to curl and from curl I was able to just add the filename and inject..

Scriptname is:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.