+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Exploit POST data logging endpoint? (/showthread.php?tid=6073894)
Exploit POST data logging endpoint? - imgoodatcpa - May 2, 2020
Hey all!
I'm new to this forum and let me say that it looks cool.
I have a question for y'all:
How would you exploit a PHP endpoint (Nginx server) which uses file_put_contents to log all that comes from post request?
Let me give you a code example:
function logtxt($log)
{
$log .= "\n";
$bt = debug_backtrace();
$caller = array_shift($bt);
$line = $caller['line'];
file_put_contents('./log_' . date("j.n.Y") . '.log', $line . ':' . $log, FILE_APPEND);
}
$message= json_decode(file_get_contents('php://input'),true);
logtxt(json_encode($message));