Instructor: Local file inclusion vulnerabilities. 2 2
These exploits or vulnerabilities allow you 3 3
to read any file that is within the same server. 4 4
So even if the file exists outside the varwww, 5 5
you'll be able to read it and read info with it. 6 6
Now, why this vulnerability is critical 7 7
because you can read any files, 8 8
so if the users are storing some sort of important files 9 9
or password files, then you'll be able to read them 10 10
and then from there you can further exploit your target. 11 11
Also, if there's a number of websites on the same server, 12 12
and you manage to find this on a website 13 13
that you're not targeting, 14 14
then you might be able to access files related 15 15
to the website that you're targeting 16 16
and then further exploit your website from there. 17 17
So let's have a look on this, 18 18
and we'll also, the way we're going to be 19 19
exploiting this vulnerability is through the URL. 20 20
So usually in our code execution example, 21 21
we were writing the code in here, 22 22
now sometimes you might find 23 23
the code vulnerability in the URL, 24 24
so it'll be something like CMD, 25 25
and then you put the command, 26 26
or for example, in this case, 27 27
it would be IP equals to the IP for example, 28 28
1020, 29 29
14, 30 30
two O three, and then you put the sign 31 31
and then you put your PWD after it for example, 32 32
so cause our example was just in the text box, 33 33
same is gonna happen here, 34 34
in our file inclusion vulnerability. 35 35
So we can see that when you're in here, 36 36
in this URL, it's saying that this 37 37
file is going to take a page 38 38
and it's loading something called include the PHP, 39 39
so it looks like it's actually loading another page, 40 40
like this current page is loading another page, 41 41
called include the PHP, 42 42
so again you'd be browsing the web server 43 43
and trying to get a feel of it, 44 44
and you see something like this, 45 45
or you see something called IP equals 46 46
the IP and then you know that there's a ping, 47 47
for example, for the previous video, 48 48
so for this, now we know that our target's 49 49
trying to open a file, 50 50
and the file is called include the PHP. 51 51
Let's see if there is actually 52 52
a file called include the PHP, 53 53
so I'm just gonna remove everything here, 54 54
and try to access include the PHP directly, 55 55
and as we can see, we actually do have a file 56 56
called include the PHP, 57 57
it's not running properly, 58 58
but it exists and it's in the same working directory, 59 59
so, 60 60
let's try and see if we can read a file 61 61
that is stored in the computer, 62 62
and we're going to use a file called ETC password. 63 63
So that's the file which contains all the users 64 64
and their paths on the current web server. 65 65
So, 66 66
let's have a look on this, 67 67
so ETC, 68 68
this file contains all the users 69 69
for the current operating system. 70 70
So if I just go on my caddy right here, 71 71
and if I run it here, 72 72
if I just do cat, 73 73
etc password, you'll see all the users that I have 74 74
on the current computer, 75 75
and their default path on the current operating system. 76 76
So, we're going to try to read this file, 77 77
and to do that, 78 78
let's go back and see our current location. 79 79
So our current location is in the FI file, 80 80
and the FI directory, 81 81
so we need to go back, 82 82
one, two, three, four, five times and then 83 83
go to ETC password, 84 84
so going back would be done using the dot dot, 85 85
and let's try and do that. 86 86
So, at the moment we're accessing this current file, 87 87
and just to make it easier for you actually, 88 88
let's just put the full path right here, 89 89
so in the page, it's trying to access this page, 90 90
so what we need, we actually want a place called 91 91
ETC password, so we need to go back 92 92
five times for these directories, 93 93
so this one is going to be the start time from here, 94 94
so we're going back, 95 95
back, 96 96
back, 97 97
back, 98 98
and back, and then we're going to go to ETC 99 99
password, 100 100
and as you can see, now we have the output 101 101
of the ETC password file, 102 102
we can copy that and store it here, 103 103
and then you'll be able to read it 104 104
and just get more information about the websites 105 105
that you're targeting right now. 106 106
Again you can use this to try to access 107 107
different files, sensitive files, or files 108 108
of other websites on the same server.