New answers tagged php
1
Yes, you can..
Assuming you know the table name and union is not blocked, you can dump that table's data.
MariaDB [security]> select `2` from (select 1,2,3 union select * from user)a;
This will dump the second column's data. What happens is that when we first select 1,2,3 before selecting the columns from the table the name of the columns is changed ...
0
By adding VPN, you are also reaching a critical unusability threshold for marginal security improvement.
Consider the decision as a time-cost vs security matter. If you have 1000 staff, and you are wasting 1 hour of time per week, that's 1000 hours per week. What if that time budget was spent on hardening the software implementation instead?
You should ...
2
Yes, it is possible e.g. using php wrappers.
A simple RCE could be done like this :
https://yoursite.com/?img_name=expect://ls
Note: This will work only if php configuration allow wrappers.
More details here : https://highon.coffee/blog/lfi-cheat-sheet/
Edit: You might need to URL encode the payload :
https://yoursite.com/?img_name=expect%2E%2F%2Fls
4
First of all, I assume that you are the owner of the website disclosing the phpinfo, and you ask this for academic purposes.
To achieve what you said, I would do the following :
Create an invisible iframe (0px x 0px)
Store cookies in var x by parsing the iframe content through contentDocument getter/setter
Create an invisible <img/> (0px x 0px) with ...
Top 50 recent answers are included
