Howdy, Stranger!
It looks like you're new here. If you want to get involved, click one of these buttons!
Top Posters
Who's Online (0)
Powered by Vanilla.
Made with Bootstrap.
Doubt regarding Local File Inclusion(PHP Knowledge enough)
-
Let this be the LFI Vulnerable script
<?php<br /> $file = str_replace('../', '', $_GET['file']);
if(isset($file))
{
include("pages/$file");
}
else
{
include("index.php");
}
?>
And we pass
http://example.com/index.php?file=..%2F..%2F..%2F..%2Fetc%2Fpasswd to attack
But how exactly is the file included now? Wont the scipt now be equivalent so that $file = ..%2F..%2F..%2F..%2Fetc%2Fpasswd
Only browser knows 2F = '/' so how can server include the file? HOw does it exactly understands it??
Danks>
Xin R
