Questions tagged [lfi]
The lfi tag has no usage guidance.
15
questions
0
votes
1answer
42 views
Bypass Local File Inclusion(LFI) prevention filters
I have these two LFI filters and i want to bypass them
$bad = str_replace('../','',$_GET['bad']);
while( substr_count($bad, '../', 0)) {
$bad = str_replace('../', '', $bad);...
1
vote
1answer
54 views
What can a lfi without ssh open be used for
If a server has LFI vulnerability, I usually try to find if ssh is open and after some research if I can't find any spilt credentials, I just bruteforce it or something.
Can I use a LFI vulnerability ...
2
votes
3answers
90 views
LFI php://input returning initial argument?
TLDR: Trying to execute commands on site thats got a LFI vuln.
So I am making my post request to my vulnerable site and
import requests
header = {
'User-Agent':'Mozilla/5.0 (Windows; U; ...
3
votes
1answer
838 views
How can I read local files from blind XSS?
When I do one of these payloads, I can see /etc/passwd:
<iframe src=file:///etc/passwd></iframe>
<img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
0
votes
1answer
85 views
How can you find the PHP version a website is using using LFI?
If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
2
votes
2answers
2k views
LFI filter bypass
$patterns[0] = '/[^[:print:]]+/'; // remove non-printable characters
$patterns[1] = '/[ \t]+$/'; // remove whitespace at end of string
$patterns[2] = '/^[ \t]+/'; // remove whitespace at ...
1
vote
2answers
368 views
Attacking through a malicious HTML file apart from XSS through Javascript?
I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
0
votes
1answer
691 views
LFI to RCE through User-Agent
I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
0
votes
1answer
395 views
How to Create file name with Slash in it for Path traversal attack?
Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
1
vote
0answers
295 views
Exploiting LFI with prefix in PHP?
I have a scenario as the following:
<?php include("resource/" + $_GET['vuln']); ?>
And I'm trying to get RCE from this, or atleast acquire some interesting information.
I already looked at /...
1
vote
2answers
241 views
PHP Local File Inclusion from URL; no param
The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path.
The $path argument is /...
1
vote
2answers
413 views
Local file inclusion to RCE
Here is the code:
<?php
$file=trim($_GET['img_name']);
//echo $file;
if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream'...
0
votes
1answer
95 views
Attack Web Forms dvwa to achieve lfi
Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server?
Is there a endpoint to hit for this?
...
0
votes
1answer
243 views
PHP LFI fix with the right file permissions
I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions.
...
6
votes
3answers
2k views
Can there be a way to exploit PHP include_once() when the input is filtered?
Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice):
$input = addslashes($_GET["input"]);
if (strpos($input, '../') === false) {
...
