Attack Web Forms dvwa to achieve lfi

Question

Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server?

Is there a endpoint to hit for this?

Thanks

https://medium.com/@Aptive/local-file-inclusion-lfi-web-application-penetration-testing-cc9dc8dd3601 — yeah_well, Apr 06 '19 at 10:58
Yes I saw this for in the `url` but not via a form field... do you know where to find that — JShee, Apr 06 '19 at 12:07
You wont find it in DVWA.But you can code it yourself.Simple take the filename via post request instead of GET and in the backend include that file without any validation. — yeah_well, Apr 06 '19 at 12:14
@VipulNair - How to do this: Simple take the filename via post request instead of GET and in the backend include that file without any validation — Jshee, Apr 09 '19 at 12:45
I dont have the laptop right now.I will write you the code in a few hours — yeah_well, Apr 09 '19 at 12:54

score 1 · Answer 1 · answered Apr 09 '19 at 16:29

<?php

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $file=$_POST['filename'];
include($file);
}?>
    <html>
    <title>test</title>
    <head>
    </head>
    <body>
    <form method="post" action="index.php">
    <p>filename<input type="text" name="filename"><p>
    </form>
    </body>
    </html>

This is usually the vulnerable back end code for Local file inclusion.If you intercept the request and change the filename parameter you can read data from the victim server.This code can also result in remote file inclusion if allow_url_include is turned on.

Attack Web Forms dvwa to achieve lfi

1 Answers1