LFD - Local file Download / Disclosure

LFD - Local file Download / Disclosure - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: LFD - Local file Download / Disclosure (/Thread-LFD-Local-file-Download-Disclosure)

LFD - Local file Download / Disclosure - rootaccess - 05-17-2014

Hey everyone, i found something interesting
for our " Website Hacking Section "

Local File Download/Disclosure. 龙

imagine we have a website where we can download files on the website like this :

Code:
download.php?file=123.pdf

Now if we do this replace 123.pdf with download.php like this :

Code:
download.php?file=download.php

now if it successfully downloads the download.php, it has LFD Vulnerability. For getting information on the site we can get index.php instead of download.php file, or any other file u want to download, from the server

so now, we have downloaded the file to our computer, we can check for valuable things in the source code, such as logins and other valuable info
for instance, on some servers u can download configuration.php

An example of a vulnerable webserver :

Code:
http://www.goldenking.gr/download.php?file=download.php

Code:
http://www.goldenking.gr/download.php?file=index.php

龙 Shared by me for the Community Heart

Have fun and stay Safe..

RE: LFD - Local file Download / Disclosure - superMAUS - 05-17-2014

Good share. I would think most people know this though.

RE: LFD - Local file Download / Disclosure - rootaccess - 05-17-2014

(05-17-2014, 03:20 PM)vegimite Wrote: Good share. I would think most people know this though.

oh well i found about this today
so i decided to share it thanks for liking it though Smile

RE: LFD - Local file Download / Disclosure - ICE_ - 05-27-2014

Good share, you'd think most people know this already but what ever, a share is a share.

RE: LFD - Local file Download / Disclosure - rootaccess - 06-01-2014

(05-27-2014, 11:56 PM)ICE_ Wrote: Good share, you'd think most people know this already but what ever, a share is a share.

exactly, i didnt know about this before
i posted this.

RE: LFD - Local file Download / Disclosure - Eclipse - 06-01-2014

You could download things like the passwd file and the shadow file.