[Skidy]

I found a websites wp-include's directory and they hav't hidden parent directories. Meaning I can view files like this:



However, everytime I right click and save link as for a .php file. It saves and nothing is in the file. How can I download these files to see the php code? They can't just be empty documents.

[Exodi]

It's impossible. Otherwise you could download the config.php and just hack it actually.

[Delevingne]

Are you serious? Are you 100% serious? Or just a bad troll?

[Mr.0_0]

You cant download them via a browser or using the CLI. For one, you can use a browser because you dont have read access to the files and you cant use the command line because PHP is server-side. Unless you can change the privileges on the server itself pertaining these files, thats all youre going to get: a directory listing. If someone tells you otherwise, theyre bullshitting.

EDIT: Holy crap lol i seen all these replies when I submitted my response. I stand corrected.

[ProblemSolva]

Try to find a other vulnerability, since php is a server sided language you wont see a thing, however if you find a LFD, or an lfi where you can use the base64 encode, then you can get the php code

[#Skyline]

I laugh at the php file part.

And you cannot see anything as PHP is server sided.
Try finding a vuln, as stated above.