search

Automated Scanning

hashtag
Fuzzing Parameters

The Attacking Web Applications with Ffufarrow-up-right module goes into details on how we can fuzz for GET/POST parameters. For example, we can fuzz the page for common GET parameters, as follows:

eldeim@htb[/htb]$ ffuf -w /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u 'http://<SERVER_IP>:<PORT>/index.php?FUZZ=value' -fs 2287

...SNIP...

 :: Method           : GET
 :: URL              : http://<SERVER_IP>:<PORT>/index.php?FUZZ=value
 :: Wordlist         : FUZZ: /opt/useful/seclists/Discovery/Web-Content/burp-parameter-names.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403
 :: Filter           : Response size: xxx
________________________________________________

language                    [Status: xxx, Size: xxx, Words: xxx, Lines: xxx]

Tip: For a more precise scan, we can limit our scan to the most popular LFI parameters found on this linkarrow-up-right.

hashtag
LFI wordlists

There are a number of LFI Wordlistsarrow-up-right we can use for this scan. A good wordlist is LFI-Jhaddix.txtarrow-up-right, as it contains various bypasses and common files, so it makes it easy to run several tests at once. We can use this wordlist to fuzz the ?language= parameter we have been testing throughout the module, as follows:

hashtag
Fuzzing Server Files

hashtag
Server Webroot

To do so, we can fuzz for the index.php file through common webroot paths, which we can find in this wordlist for Linuxarrow-up-right or this wordlist for Windowsarrow-up-right. Depending on our LFI situation, we may need to add a few back directories (e.g. ../../../../), and then add our index.php afterwords.

The following is an example of how we can do all of this with ffuf:

As we can see, the scan did indeed identify the correct webroot path at (/var/www/html/). We may also use the same LFI-Jhaddix.txtarrow-up-right wordlist we used earlier, as it also contains various payloads that may reveal the webroo

hashtag
Server Logs/Configurations

To do so, we may also use the LFI-Jhaddix.txtarrow-up-right wordlist, as it contains many of the server logs and configuration paths we may be interested in. If we wanted a more precise scan, we can use this wordlist for Linuxarrow-up-right or this wordlist for Windowsarrow-up-right, though they are not part of seclists, so we need to download them first. Let's try the Linux wordlist against our LFI vulnerability, and see what we get:

As we can see, the scan returned over 60 results, many of which were not identified with the LFI-Jhaddix.txtarrow-up-right wordlist, which shows us that a precise scan is important in certain cases. Now, we can try reading any of these files to see whether we can get their content. We will read (/etc/apache2/apache2.conf), as it is a known path for the apache server configuration:

As we can see, we do get the default webroot path and the log path. However, in this case, the log path is using a global apache variable (APACHE_LOG_DIR), which are found in another file we saw above, which is (/etc/apache2/envvars), and we can read it to find the variable values:

As we can see, the (APACHE_LOG_DIR) variable is set to (/var/log/apache2), and the previous configuration told us that the log files are /access.log and /error.log, which have accessed in the previous section.

hashtag
LFI Tools

Finally, we can utilize a number of LFI tools to automate much of the process we have been learning, which may save time in some cases, but may also miss many vulnerabilities and files we may otherwise identify through manual testing. The most common LFI tools are LFISuitearrow-up-right, LFiFreakarrow-up-right, and liffyarrow-up-right. We can also search GitHub for various other LFI tools and scripts, but in general, most tools perform the same tasks, with varying levels of success and accuracy.

hashtag
PoCs - Questions

  • Fuzz the web application for exposed parameters, then try to exploit it with one of the LFI wordlists to read /flag.txt

First, in the website, fuzzing to LFI -->

With it we nedf fuzz by the directories -->

PreviousRemote Code ExecutionNextSkills Assessment

Last updated