+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Advanced Exploitation Techniques (/Thread-Advanced-Exploitation-Techniques)
RE: Advanced Exploitation Techniques - dR.0xYw0Rm - 10-27-2013
(08-11-2013, 02:51 PM)zomgwtfbbq Wrote: You could have told why RFI isn't so common these days and why allow_url_include is turned off.
Also your RFI example can't work unless you add a poison null byte to the url which will discard the php extension, otherwise:
http://yourevilsite.com/shell.txt > http://yourevilsite.com/shell.txt.php
I'm sorry to say this tutorial isn't so original, it's like every tutorial you come across nowadays is either xss, sqli, rfi or lfi related, while there are so many other types of vulnerabilities.
Don't want to sound negative but it's just the way I feel.
Totally agree with you , also I don't see any advanced methods, rfi,ssi or lfi aren't advanced at all.
Anyway it will come handy to some members.
RE: Advanced Exploitation Techniques - dR.0xYw0Rm - 10-27-2013
(08-11-2013, 02:51 PM)zomgwtfbbq Wrote: You could have told why RFI isn't so common these days and why allow_url_include is turned off.
Also your RFI example can't work unless you add a poison null byte to the url which will discard the php extension, otherwise:
http://yourevilsite.com/shell.txt > http://yourevilsite.com/shell.txt.php
I'm sorry to say this tutorial isn't so original, it's like every tutorial you come across nowadays is either xss, sqli, rfi or lfi related, while there are so many other types of vulnerabilities.
Don't want to sound negative but it's just the way I feel.
Totally agree with you , also I don't see any advanced methods, rfi,ssi or lfi aren't advanced at all.
Anyway it will come handy to some members.
RE: Advanced Exploitation Techniques - dR.0xYw0Rm - 10-27-2013
(08-11-2013, 02:51 PM)zomgwtfbbq Wrote: You could have told why RFI isn't so common these days and why allow_url_include is turned off.
Also your RFI example can't work unless you add a poison null byte to the url which will discard the php extension, otherwise:
http://yourevilsite.com/shell.txt > http://yourevilsite.com/shell.txt.php
I'm sorry to say this tutorial isn't so original, it's like every tutorial you come across nowadays is either xss, sqli, rfi or lfi related, while there are so many other types of vulnerabilities.
Don't want to sound negative but it's just the way I feel.
Totally agree with you , also I don't see any advanced methods, rfi,ssi or lfi aren't advanced at all.
Anyway it will come handy to some members.
RE: Advanced Exploitation Techniques - dR.0xYw0Rm - 10-27-2013
(08-11-2013, 02:51 PM)zomgwtfbbq Wrote: You could have told why RFI isn't so common these days and why allow_url_include is turned off.
Also your RFI example can't work unless you add a poison null byte to the url which will discard the php extension, otherwise:
http://yourevilsite.com/shell.txt > http://yourevilsite.com/shell.txt.php
I'm sorry to say this tutorial isn't so original, it's like every tutorial you come across nowadays is either xss, sqli, rfi or lfi related, while there are so many other types of vulnerabilities.
Don't want to sound negative but it's just the way I feel.
Totally agree with you , also I don't see any advanced methods, rfi,ssi or lfi aren't advanced at all.
Anyway it will come handy to some members.