+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: php code injection to shell (/showthread.php?tid=5877651)
php code injection to shell - getvoucher - Aug 24, 2018
PHP code injection to shell
This tut is about how to upload shell with php
RE: php code injection to shell - daniterrer - Sep 4, 2018
nice one, thanks you for this video
RE: php code injection to shell - Phizo - Sep 5, 2018
Honestly, this is a terrible and misleading example of PHP code injection. Login credentials would never be passed to eval() in such a manner. If you don't know how even simple authentication works, you shouldn't use it in your demonstration. Frankly, it's a bad tutorial all around. It's obvious you don't even understand how or why this works, only that you can do it. That's not a tutorial. If you want to know how this works, as well as how to write or even partially simulate an actual login, read the PHP documentation. The former, i.e. Complex (curly) syntax ({${expression}}), can be read about here: http://php.net/manual/en/language.types.string.php#language.types.string.parsing.complex. Learn to make before you break.
RE: php code injection to shell - M L T - Sep 5, 2018
(Sep 5, 2018 12:12 AM)Phizo Wrote: Honestly, this is a terrible and misleading example of PHP code injection. Login credentials would never be passed to eval() in such a manner. If you don't know how even simple authentication works, you shouldn't use it in your demonstration. Frankly, it's a bad tutorial all around. It's obvious you don't even understand how or why this works, only that you can do it. That's not a tutorial. If you want to know how this works, as well as how to write or even partially simulate an actual login, read the PHP documentation. The former, i.e. Complex (curly) syntax ({${expression}}), can be read about here: Learn to make before you break.
Phizo? Still around? Damn, now that's a name I haven't seen in a long time. Unsure if you even remember me.
RE: php code injection to shell - Phizo - Sep 5, 2018
(Sep 5, 2018 02:02 AM)M L T Wrote: Phizo? Still around? Damn, now that's a name I haven't seen in a long time. Unsure if you even remember me.
I don't really come on here much anymore, but still around. :~)
Met up with K4Fr a few months ago when he was down here for work.