Questions tagged [lfi]
The lfi tag has no usage guidance.
4
questions
1
vote
1answer
98 views
Local file inclusion to RCE
Here is the code:
<?php
$file=trim($_GET['img_name']);
//echo $file;
if (file_exists($file)) {
header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream'...
0
votes
1answer
66 views
Attack Web Forms dvwa to achieve lfi
Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server?
Is there a endpoint to hit for this?
...
0
votes
1answer
161 views
PHP LFI fix with the right file permissions
I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions.
...
6
votes
3answers
675 views
Can there be a way to exploit PHP include_once() when the input is filtered?
Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice):
$input = addslashes($_GET["input"]);
if (strpos($input, '../') === false) {
...
