[superMAUS]

So just wondering say I come across something like this:

file=/sdsd/sdsd/file


Lets presume file is referring to file.html, is there anyway I can bypass the fact that the file will be handled as $_GET['file'] + ".html"? Say with # or something?

Thanks,

[tortilla]

So just wondering say I come across something like this:

file=/sdsd/sdsd/file


Lets presume file is referring to file.html, is there anyway I can bypass the fact that the file will be handled as $_GET['file'] + ".html"? Say with # or something?

Thanks,

Try adding null at end.
file=/sdsd/sdsd/file%00

[superMAUS]

Try adding null at end.
file=/sdsd/sdsd/file%00

Thanks very much tortilla, do you know if this the only method you can utilize?

[rootaccess]

maybe u find this link interesting
http://diablohorn.wordpress.com/2010/01/...on-method/

[Cake]

maybe u find this link interesting
http://diablohorn.wordpress.com/2010/01/...on-method/

I found that link interesting.
And now I know a couple more things I can do to secure my stuff.

[rootaccess]

I found that link interesting.
And now I know a couple more things I can do to secure my stuff.

you are welcome man.
i just searched google for local file inclusion bypasses

[superMAUS]

Thanks @rootaccess, looks interesting.

[rootaccess]

You are welcome peeps
Just trying to share to this
Awesome community