File Vulnerabilities
LFI
local file inclusion happens when it is possible to access files stored on the target's system by passing a relative path to a parameter of a request. The number of "up one level instructions" is irrelevant because once we reach the root level, the additional "go up" instructions will be ignored.
See LFI List for a list of possible target files for tests
Payloads
Importing with file modifiers
Disclose PHP file source code
Execute webshell from a ZIP file. The webshell extension ca be omitted
RFI
Remote file inclusion happens when an attacker is able to make a web server include and execute files hosted on a different server controlled by the attacker. For instance by making a parameter point to an url of a file such as a reverse shell written in php it is possible to make the server follow the url and execute the shell
See PHP shells for shells to be used in an attack. Keep in mind that these files MUST be stored as .txt files instead of their executable format (.php, .jsp, .asp). If you don't do this the malicious code will be executed on your local server instead of the remote one
Payloads
File upload functionality
Filename payloads
Evade file restrictions
Changing the content type header when trying to upload reverse shells can bypass simple files detection systems.
These strings are effective in evading file upload checks only if the server does not check the actual file signature but checks only the extension.
Magic bytes
To bypass file controls based on MIME type and file signature insert the following bytes sequences at the beginning of the file to change its type and edit file extension accordingly. Once the file is stored on the server you will have to find a way to edit it back in order to restore its origina behavior when opened
ImageTrick vulnerability
Save this code snippet in a text file and upload it to receive a reverse shell
Last updated