Mirrors/fuzzdb
2
0
Fork 0
mirror of https://github.com/fuzzdb-project/fuzzdb.git synced 2024-11-23 03:23:03 +00:00
Code Issues Projects Releases Packages Wiki Activity
fuzzdb/attack/lfi
History
Adam Muntner a58bdb659d doc relocation and renaming update
2015-09-11 19:39:11 -04:00
..
common-ms-httpd-log-locations.fuzz.txt doc relocation and renaming update 2015-09-11 19:39:11 -04:00
common-unix-httpd-log-locations.fuzz.txt doc relocation and renaming update 2015-09-11 19:39:11 -04:00
README.md doc relocation and renaming update 2015-09-11 19:39:11 -04:00

README.md

LFI - Local File Include attacks

To exploit an LFI bug, you need to be able to write code to a local file and call it from the include. HTTPD log files are a location that is typically writable.

common-unix-httpd-log-locations.fuzz.txt

To exploit a lfi bug, you have to get code into a local file. This list contains a list of common unix logfile locations based on common packages formats.

common-windows-httpd-log-locations.fuzz.txt

To exploit a lfi bug, you have to get code into a local file. This list contains a list of common windows logfile locations based on common packages formats.

For more details: http://www.wtfchan.org/~evil1/Web-Shells-rev2.pdf

other tools: fimap http://code.google.com/p/fimap/