• XSS.stack #1 – первый литературный журнал от юзеров форума

Интересует тема LFI, RFI

these vulns are not really over complicated so there is not a lot of different documentations, books. Most of papers wil lfocus on exotic waf bypass techniques.

So yo uwill have the local file inclusion fundamentals by reading these :

and for remote file inclusion (you don't even need a documentation for this) :

Also reading reports from hackerone or reading some exploits using LFI on exploitdb can be usefull to see exotics usages, or chained usages. Sometimes you will have LFI but not acces to some files and wrappers. So for example if you only have acces to filter wrapper for example you could get the source code of a page php://filter/convert.base64-encode/resource=config.php to try to steal db passwords, then access it, steal admin pass, access panel, find new vulns, chain it and get rce. It's a dumbass example I gave but I hope you see what I mean.
 
Подскажите пожалуйста где можно найти книги или ресурсы по тематике Local File Inclusion, Remote File Inclusion. Поиск и применение. Благодарю за помощь!
 
не знаете, есть бесплатные аналоги?
 
Последнее редактирование:


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх