Questions tagged [lfi]
The lfi tag has no usage guidance.
3
questions
0
votes
1answer
60 views
Attack Web Forms dvwa to achieve lfi
Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server?
Is there a endpoint to hit for this?
...
0
votes
1answer
132 views
PHP LFI fix with the right file permissions
I'm trying to understand how to perform a LFI (specifically PHP LFI), and there is a aspect of this attack that seems to be never discussed in online articles I read: The injected file permissions.
...
6
votes
3answers
636 views
Can there be a way to exploit PHP include_once() when the input is filtered?
Let's assume there is this code for including other php files from user input (yes, I know it's a bad choice):
$input = addslashes($_GET["input"]);
if (strpos($input, '../') === false) {
...
