Hot answers tagged

4

First of all, I assume that you are the owner of the website disclosing the phpinfo, and you ask this for academic purposes. To achieve what you said, I would do the following : Create an invisible iframe (0px x 0px) Store cookies in var x by parsing the iframe content through contentDocument getter/setter Create an invisible <img/> (0px x 0px) with ...


2

EDIT: I misunderstood the question, original answer below Standard HTTPS will protect everything from evesdroppers on the network; the POST data, any HTTP headers, cookies, even the URL that they are accessing. If your site has standard HTTPS, then you do not need extra encryption of the content. Yes, you can remove that extra call to ...


2

Yes, it is possible e.g. using php wrappers. A simple RCE could be done like this : https://yoursite.com/?img_name=expect://ls Note: This will work only if php configuration allow wrappers. More details here : https://highon.coffee/blog/lfi-cheat-sheet/ Edit: You might need to URL encode the payload : https://yoursite.com/?img_name=expect%2E%2F%2Fls


1

Yes, you can.. Assuming you know the table name and union is not blocked, you can dump that table's data. MariaDB [security]> select `2` from (select 1,2,3 union select * from user)a; This will dump the second column's data. What happens is that when we first select 1,2,3 before selecting the columns from the table the name of the columns is changed ...


Only top voted, non community-wiki answers of a minimum length are eligible