1

I am doing a CTF image now, and I need to upload a .zip file to execute using the php wrapper zip:// using this PHP ZIP Wrapper LFI vulnerability

The problem is that the only way to upload is with a POST form, so I would like to intercept the POST, submit and change the text I added for the binary data of the zip file.

I have tried to cat the *.zip file and paste it before continuing the POST but it did not work.

Some people suggested using Burp but I would like to know how to do this with Zap proxy.

2
  • The basic idea in Burp will also work in Zap.
    – schroeder
    Commented Feb 6, 2018 at 10:05
  • Hello, ok and what is this idea so I can try it on zap? I do not use burp. My idea is to be able to select the file and inject it, I do not see any option on zap for this, (as far I can see), I have try with curl witrh @file but this did not work Commented Feb 6, 2018 at 15:25

1 Answer 1

0

Ok well is not exactly what I wanted but in zap if you go to the url with the form.. then intercept and instead of injecting I was able to select the post, then use one of the build in scripts in ZAP to convert to curl and from curl I was able to just add the filename and inject..

Scriptname is:
curl_command_generator.js

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .