Подскажите пожалуйста где можно найти книги или ресурсы по тематике Local File Inclusion, Remote File Inclusion. Поиск и применение. Благодарю за помощь!
-
XSS.stack #1 – первый литературный журнал от юзеров форума
Интересует тема LFI, RFI
- Автор темы Miron115
- Дата начала
freehacks.io - Ressources et information concernant freehacks Resources and Information.
freehacks.io réunit des informations et annonces. Nous espérons que vous y trouverez les informations que vous recherchez !
freehacks.io
these vulns are not really over complicated so there is not a lot of different documentations, books. Most of papers wil lfocus on exotic waf bypass techniques.
So yo uwill have the local file inclusion fundamentals by reading these :
owasp.org
and for remote file inclusion (you don't even need a documentation for this) :
owasp.org
Also reading reports from hackerone or reading some exploits using LFI on exploitdb can be usefull to see exotics usages, or chained usages. Sometimes you will have LFI but not acces to some files and wrappers. So for example if you only have acces to filter wrapper for example you could get the source code of a page php://filter/convert.base64-encode/resource=config.php to try to steal db passwords, then access it, steal admin pass, access panel, find new vulns, chain it and get rce. It's a dumbass example I gave but I hope you see what I mean.
So yo uwill have the local file inclusion fundamentals by reading these :
WSTG - v4.2 | OWASP Foundation
WSTG - v4.2 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
owasp.org
File Inclusion/Path traversal - HackTricks
book.hacktricks.xyz
and for remote file inclusion (you don't even need a documentation for this) :
WSTG - v4.2 | OWASP Foundation
WSTG - v4.2 on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
owasp.org
Also reading reports from hackerone or reading some exploits using LFI on exploitdb can be usefull to see exotics usages, or chained usages. Sometimes you will have LFI but not acces to some files and wrappers. So for example if you only have acces to filter wrapper for example you could get the source code of a page php://filter/convert.base64-encode/resource=config.php to try to steal db passwords, then access it, steal admin pass, access panel, find new vulns, chain it and get rce. It's a dumbass example I gave but I hope you see what I mean.
File Inclusion
This room introduces file inclusion vulnerabilities, including Local File Inclusion (LFI), Remote File Inclusion (RFI), and directory traversal.
tryhackme.com
- Автор темы
- Добавить закладку
- #5
не знаете, есть бесплатные аналоги?File Inclusion
This room introduces file inclusion vulnerabilities, including Local File Inclusion (LFI), Remote File Inclusion (RFI), and directory traversal.
Kontra Application Security Training
Kontra is an Application Security Training platform built for modern development teams.
application.security
Ну и все знают portswigger academy,hacktebox academy
Последнее редактирование: