0

Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server?

Is there a endpoint to hit for this?

Thanks

  • 1
    medium.com/@Aptive/… – Vipul Nair Apr 6 '19 at 10:58
  • Yes I saw this for in the url but not via a form field... do you know where to find that – JShee Apr 6 '19 at 12:07
  • You wont find it in DVWA.But you can code it yourself.Simple take the filename via post request instead of GET and in the backend include that file without any validation. – Vipul Nair Apr 6 '19 at 12:14
  • @VipulNair can you please provide a sample? – Jshee Apr 9 '19 at 12:40
  • sample of what? – Vipul Nair Apr 9 '19 at 12:42
1
<?php

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $file=$_POST['filename'];
include($file);
}?>
    <html>
    <title>test</title>
    <head>
    </head>
    <body>
    <form method="post" action="index.php">
    <p>filename<input type="text" name="filename"><p>
    </form>
    </body>
    </html>

This is usually the vulnerable back end code for Local file inclusion.If you intercept the request and change the filename parameter you can read data from the victim server.This code can also result in remote file inclusion if allow_url_include is turned on.

  • Awesome, thank you! – Jshee Apr 9 '19 at 16:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.