There is a site whose main page is in the formathttp://example.com/index.php?page=1. It contains a rectangular box with text in it. What vulnerabilities can I use to find a hidden file on this site?

I have tried:

1) Putting another number or ASCII string instead of 1. It yields the same rectangular frame, but without text. I also tried putting a very large number and UTF-8 characters too, the result is the same. I get the same frame.

2) Checked the source code of pages. No results.

  • Did you try SQL inejction? – Reinstate Monica Sep 12 '18 at 16:55
  • What do you mean? I don't have a user or password field there. I will try to google if it can be used otherwise. – student28 Sep 12 '18 at 16:57
  • 4
    Finding vulnerabilities isn't magic. There isn't a one-size-fits-all solution to finding them. I'd recommend starting with information gathering. Map the site as best as you can, then start looking for potential points of ingress. – Mr. Llama Sep 12 '18 at 16:57
  • Any tips on that? The site looks infinite, whatever page number I type, it still displays the frame. – student28 Sep 12 '18 at 17:01

I believe what you can be possible do in this case is an LFI execution. As I see the url ends with php?page=1 which means it looks for a certain document inside the server and displays it.

You may also retreive some dump from the database if it's vulnerable to SQL Injection. So as said you can test the following

Local File Inclusion - Check to see if there is any vulnerability that retreives files from the server by the application being vulnerable to characters such as . and / e.g. (../../etc/passwd) as an example

SQL Injection - Also you can use this technique to access "file" which I beleive may be the .db that your looking for maybe.

There other types of vulnerabilities too but by only looking at it and at the specific URL these may be it.

| improve this answer | |
  • Tried the .//.//etc/passwd trick. Got me a strange 403 message ("Access denied: you little hacker"). I feel I am somewhere close. – student28 Sep 12 '18 at 17:19
  • The OP says that any number results in the same response, so your claim that "it looks for a certain document inside the server and displays it" is not correct – schroeder Sep 12 '18 at 18:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.