Questions tagged [lfi]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
42 views

Bypass Local File Inclusion(LFI) prevention filters

I have these two LFI filters and i want to bypass them $bad = str_replace('../','',$_GET['bad']); while( substr_count($bad, '../', 0)) { $bad = str_replace('../', '', $bad);...
1
vote
1answer
54 views

What can a lfi without ssh open be used for

If a server has LFI vulnerability, I usually try to find if ssh is open and after some research if I can't find any spilt credentials, I just bruteforce it or something. Can I use a LFI vulnerability ...
2
votes
3answers
90 views

LFI php://input returning initial argument?

TLDR: Trying to execute commands on site thats got a LFI vuln. So I am making my post request to my vulnerable site and import requests header = { 'User-Agent':'Mozilla/5.0 (Windows; U; ...
3
votes
1answer
838 views

How can I read local files from blind XSS?

When I do one of these payloads, I can see /etc/passwd: <iframe src=file:///etc/passwd></iframe> <img src="xasdasdasd" onerror="document.write('<iframe src=file:///etc/...
0
votes
1answer
85 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
2
votes
2answers
2k views

LFI filter bypass

$patterns[0] = '/[^[:print:]]+/'; // remove non-printable characters $patterns[1] = '/[ \t]+$/'; // remove whitespace at end of string $patterns[2] = '/^[ \t]+/'; // remove whitespace at ...
1
vote
2answers
368 views

Attacking through a malicious HTML file apart from XSS through Javascript?

I recently came across a behavior in a web application where the application (through the use of the header Content-Disposition: attachment) offers to download an HTML file instead of allowing it to ...
0
votes
1answer
691 views

LFI to RCE through User-Agent

I'm doing a pentest on a FreeBSD machine running CuppaCMS. Already managed to login into the CMS with admin privilege, but it only takes me to a manager menu, with some options to change some tables ...
0
votes
1answer
395 views

How to Create file name with Slash in it for Path traversal attack?

Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
1
vote
0answers
295 views

Exploiting LFI with prefix in PHP?

I have a scenario as the following: <?php include("resource/" + $_GET['vuln']); ?> And I'm trying to get RCE from this, or atleast acquire some interesting information. I already looked at /...
1
vote
2answers
241 views

PHP Local File Inclusion from URL; no param

The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path. The $path argument is /...
1
vote
2answers
413 views

Local file inclusion to RCE

Here is the code: <?php $file=trim($_GET['img_name']); //echo $file; if (file_exists($file)) { header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'...
0
votes
1answer
95 views

Attack Web Forms dvwa to achieve lfi

Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server? Is there a endpoint to hit for this? ...
0
votes
1answer
243 views

PHP LFI fix with the right file permissions

I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions. ...
6
votes
3answers
2k views

Can there be a way to exploit PHP include_once() when the input is filtered?

Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice): $input = addslashes($_GET["input"]); if (strpos($input, '../') === false) { ...