15
votes
How can I read local files from blind XSS?
<iframe src=file:///etc/passwd></iframe>
This displays a local file in the browser inside a separate iframe. This iframe has a different origin than the main frame. Due to same origin ...
- 208k
6
votes
LFI filter bypass
$pattern1 = '/[^[:print:]]+/'; // remove non-printable characters
$pattern2 = '/[ \t]+$/'; // remove whitespace at end of string
$pattern3 = '/^[ \t]+/'; // remove whitespace at beginning of string
$...
- 253
4
votes
Accepted
LFI filter bypass
Think about what will remain after things get removed. F.ex: if you remove the spaces from the following . . /. The order matters, and there isn't enough code to determine the order in which the ...
- 5,989
2
votes
Accepted
File inclusion exposed passwords
Most often when testing for LFI exploits, you try to traverse to /etc/passwd to validate that the webapp is vulnerable to LFI, not usually to find passwords. There's a few good reasons to go for /etc/...
- 941
1
vote
Is this PHP code vulnerable to LFI?
Your code seems vulnerable to path traversal/file read, not LFI.
LFI works when an attacker can execute code from a file, usually exploiting a “dynamic file inclusion” mechanism implemented in the ...
- 326
1
vote
File inclusion exposed passwords
First, the LFI issue.
OWASP Local File Include definition:
Local file inclusion (also known as LFI) is the process of including files, that are already locally present on the server, through the ...
- 55.5k
1
vote
How does Local File Inclusion (LFI) work?
Let's suppose that the english.php is the default page.
The condition if (isset($_GET["key"]) && isset($_GET["email"]) && isset($_GET["language"]) &&...
- 612
1
vote
How does Local File Inclusion (LFI) work?
Most linux distros/web servers have safe file permissions on logs. You would need to be root to read the access log. Exploitation is a puzzle, but you can just superglue various behaviours together as ...
- 5,989
1
vote
Accepted
Log poisoning prevention in the context of LFI
Notice in the linked article, the technique relies on system() which should be disabled on public-facing PHP processors. Disabling that, and other crazy funcs, should stop a large percentage (ie. ...
- 1,135
1
vote
Path traversal limited
To expand on Steffen's comment:
How far you can, or can't, go with path traversal does not directly define whether it is a vulnerability. It doesn't matter whether path traversal works at all or not. ...
- 52.1k
Only top scored, non community-wiki answers of a minimum length are eligible