Skills Assessment - File Inclusion

April 23, 2024

It is an nginx web server

So this is where we might do some LFI leads to RCE

First we did try to find some LFI with Jhaddix wordlist but it returns nothing

  • First ffuf = Jhaddix.txt

Nothing

  • Second ffuf - directory list medium

Nothing

  • Third ffuf - LFI Linux

  • Fourth fuff - default web root

Still nothing

Still nothing

Still nothing

This is the return result that is says "Invalid input detected" when i'm includidng ../../../ attack

PHP Session

This doesnt return anything

HERE IS THE ANSWER

Then just decode it using online site

First we have to create a payload that will poison the log

With this code we can exectue RCE

Then we will just use our browser to use some commands like id

Just view the files in the root directory - cd /; ls

Just cat the flag - 'cat /flag_dacc60f2348d.txt'

PreviousFile Inclusion PreventionNextWeb Attacks

Last updated