All language subtitles for 1. What are they And How To Discover Exploit Them

Local file inclusion vulnerabilities these exploits or vulnerabilities allow you to read any file that

is within the same server.

So even if the file exists outside the R W W W you'll be able to read it and read ampho with it.

Now why this vulnerability is critical because you can read any files.

So if the users are storing some sort of important files or passwords files then you'll be able to read

them.

And then from there you can further exploit your target.

Also if there is a number of Web sites on the same server and you manage to find this on a Web site

that you're not targeting then you might be able to access files related to that to the Web site that

you're targeting and then further exploit your Web site from there.

So let's have a look on this and we'll also the way we're going to be exploiting this variability is

through with your help.

So usually in our code execution example we were writing the code in here.

Now sometimes you might find the code burned a vulnerability and they are also it will be something

like ACMD.

And then you put the command or for example in this case it would be IP equals to the IP for example

10 20 30 two or three and then you do put the sign and then you put your PWT after it for example.

So because our example was just in the text box same is going to happen here and our file inclusion

vulnerability so we can see that when you're in here and this your L it's saying that this file is going

to take a page and it's loaden something called includes BHB.

So it looks like it's actually loaded another page like this current page is loading another page called

include the Ph.

So again you'd be browsing the web server and trying to get a feel of it and you see something like

this or you see something called IP equals the IP and then you know that there is a ping for example

for the previous video.

So for this that we know that our targets are trying to open a file and the file is called including

BHB.

Let's see if there is actually a file called into that page.

So I'm just going to remove everything here.

And try to access and include the PSP directly.

And as you can see we actually do have a file called into the tree.

It's not running properly but it exists and it's in the same working directory.

So let's try and see if we can read a file that is stored in the computer.

And we're going to use a file called it is the password.

So that's the file which contains all the users and their path is on the current web server.

So let's have a look on this.

So it is see this file contains all the users for the current operating system.

So if I just go on my Michaeli right here and if I run this year if I just do card each U.S. password

you'll see all the users that I have on the current computer and their default Poth on the current operating

system.

So we're going to try to read this file and to do that.

Let's go back and see our current location.

So our current location is in the file in the directory.

So we need to go back one two three four five times and then go through it you see pass or so going

back would be done using the dot dot.

And let's try and do that.

So at the moment where access in this current file.

And just to make it easier for you actually let's just put the full path right here.

So in the page it's trying to access this page.

So all we need we actually want a place called ATC password so we need to go back five times for these

directories.

So this one is going to be to start them from here.

So we're going like bag

like and back and then we're going to go out to eat you see.

And as you can see now we have the output of the ATC passwords file.

We can copy that and store it here.

And then you'll be able to read it and just get more information about the websites that you're targeting

right now again you can use this to try to access different files sensitive files or files of other

web sites on the same server.

Now let's go through the security settings and I'm I've said this to me cause I just want to show you

that the medium setting and this is actually can be exploited exactly the same way as the low level.

So the security set to Medium.

I'm going to go back to file inclusion and we're going to use the exploit the exact same way that we

did it before.

And as you can see we managed to get the contents of ATC password.