[xCaptainNutz]

Wha tutorial should I follow if I'd like to get download PHP files from a website?

[Charger]

You can't unless you find an RFI vuln or login to the file manager.

[xCaptainNutz]

You can't unless you find an RFI vuln or login to the file manager.

Any tut?

[webdev77]

Any tut?

That's not something you can just follow a tutorial and guarantee results for. Take 2 minutes and google search it. You will find several thousand pages with helpful information on the topics mentioned.

[xCaptainNutz]

That's not something you can just follow a tutorial and guarantee results for. Take 2 minutes and google search it. You will find several thousand pages with helpful information on the topics mentioned.

I have googled a bit and understood it's an injection of a shell/php script into the url where the url expects a page.

I assume this isn't possible when for instance the page expects an ID
for example:
website.com/search?uid=837 right?
The ID is then forwarded to an SQL command.

[webdev77]

I have googled a bit and understood it's an injection of a shell/php script into the url where the url expects a page.

I assume this isn't possible when for instance the page expects an ID
for example:
website.com/search?uid=837 right?
The ID is then forwarded to an SQL command.

Get/post requests are generally filtered by the website backend to prevent malicious injections. Your goal is to find a mistake in the filtering process that allows a malicious request to get through and perform the intended command.

[xCaptainNutz]

Get/post requests are generally filtered by the website backend to prevent malicious injections. Your goal is to find a mistake in the filtering process that allows a malicious request to get through and perform the intended command.

What method would you prefer, hacking into the file manager or this?