Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

[Tutorial] Exploiting an Arbitrary File Upload Vulnerability [Pics/Video]

Good job.

A little question : Can this work on any forum/website with image uploader or just using the specified dork?

Thanks
I love your tutorials! keep up the amazing work bro, forums usally have protection against that kind of stuff but some stuff like free image upload scripts im pretty sure wouldnt
nice and good work for you .... (^_^)/
Here are some more dorks for everyone, Downfall you can add these to the main post if you would like

"Powered By JAKCMS"
inurl:"wp-content/plugins/1-flash-gallery"
inurl:"user/auth/forgot"
"Powered By Digitalus cms"

There are alot more but i dont want to search through every Exploit
http://www.exploit-db.com/search/?action...filter_cve=
<3 you DOWNFALL ,,Great As always.. Your tutorials are SO great And awesome. I had a Newfolder in my PC "DOWNFALL'S TUTORIALS" where all your tutorials are saved 😝 ,,loved each and every tutorial of yours ✌
nice TUT mate keep up the good work ... xD!
(Jan 13, 2012 08:31 AM)Hooded Robin Wrote:  Another nice tutroial DownFall, great share!

PS - My camtasia died too, but im working on finding a way to wipe registry clean so we can re-install will let you know if I get it working properly...

CamStudio is a good free alternative http://camstudio.org/
it has all the basic features you need
damn, book-marked, thanks for the shells as well, and feel free to post more ttus, I've been reading almost all of yours, they're very easy to understand and follow.
(Jan 13, 2012 03:51 PM)-DownFall Wrote:  Thanks for all the feedback everyone! If you find a way to get our trials working again hit me up ^^

Damn nice tutorial mate :-)

Also here's another dork:

Code
inurl:.php "Please wait while the file is uploaded, it may take several minutes depending by the size of the file and by your internet bandwidth."
What is there not to love? Nothing!

I love your tutorials -Downfall, they work wonders!
Nice tut .. old skool! ;) they used it in facebook before it got patched lol..

Oh btw thats RFI
Quote:Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:
Code execution on the web server
Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
Denial of Service (DoS)
Data Theft/Manipulation

One of HF more HQ distributors, never leave us!
Great tutorial very detailed :)..
.
.

.
.
.
..
(Feb 12, 2012 08:05 AM)-DownFall Wrote:  Never say never, I might get my life back sometime soon lol, no joke.
Thanks though man, means a lot to me.

No problem, I just want to be polite so you don't think that we don't care about your threads. :)
Bro, it's my exploit ..
http://pastebin.com/xUFzuAW2

look the date ..

And thanks for the tuto.


Possibly Related Threads...
Thread / Author Replies Views Last Post
by OfficeInboxerMar 28, 2021 05:23 AM 3 244 Mar 28, 2021 05:23 AM
Last Post: goratberom
by t3ns4iAug 29, 2020 10:24 AM 1 93 Aug 29, 2020 10:24 AM
Last Post: f1re_w1re
by InfosecstdFeb 16, 2020 08:19 PM 1 190 Feb 16, 2020 08:19 PM
Last Post: compalabee