So hi, everyone, how are you?
I hope you guys are doing absolutely fine, instinct's it.
So guys, in this lecture, we are going to talk about what is local fighting pollution.
So before learning it first, we need to understand what is fighting pollution to fight.
Inclusion is very important to understand before understanding the local fighting pollutants, knowledge
to understand what is fighting pollution.
So fighting pollution, winnability.
So this is the kind of winnability that allows an attacker to reach sensitive information or an arbitrary
command.
Using the files is stored on the Web server or using the files that are posted on attacks Muzzin.
So this vulnerability exists mainly because of the poorly written code in the Web application and if
not taken seriously, a file includes an exploit can simply compromise the entire server by granting
full access to the attacker.
So this is how it how dangerous it is actually.
So this is the basic overview of filing glutens.
So, guys, now let's see what is local file, including the winnability that we are going to exploit
in this particular lecture.
So local filing inclusion is one of the well, we can see one of the type of filing the winnability
that allows the attacker to use the vulnerable file stored in a Web server to his or her own advantage.
So Web server uses different files to execute different functions on a website based on the requirements
of the user's.
Suppose if you talk about, for example, like if you want to download something from the website that
the Web server will call the function, that will simply lead to the download page and that will allow
you download the data.
So when you see any kind of you are like downloading.
So you will see at the end you will find like a page is equal to like.
Download.
So this is this is the way it looks like when you try to download it, so using local file, including
winnability, so the attacker tampers the United Parramatta's you can see it, we are tampering here.
So you are a barometer to send a different data to the Web server to simply execute.
So instead of downloading the data that I could out to execute different functions, to get other sensitive
data from the website.
So in this particular lecture, we are going to what we are going to do here is we are going to simply
use that to try to get the content of ETEK password file that will be stored inside this Web server.
So don't worry if this is not clear to you at that at this particular moment.
So for the in this particular period, we are going to decode each and everything.
So don't worry.
So first of all, what we need to do here is we need to simply jeno security to law.
Yes, it isn't law.
So when you get inside the file inclusion, which you will find here, you will see there is nothing
to enter.
So what we need to do here is, as I told you earlier, that we are going to get the file.
We are going to attack on the U.S. system.
So now let's understand it.
So what is this?
So this is the file.
This is the link, actually, Urin.
And this is the file which is included.
So the piece that we are seeing here, this is because of include DOT.
And this is what it is doing.
It is simply requesting passage equal to include not BHB.
That is where the swinger's.
So now let's see.
What I'm going to do here is let's see this pages here inside this or not.
So when you hit enter.
OK.
It is doing nothing here.
OK, let's go back and what the next time that we can do here is let's try to.
See, OK, let's try to see what what this thing is here.
So when you analyze this, you will find this is included.
This is the directory fee F.I. and this is one one more data, which is vulnerability.
And this is developed.
David Eluay, I noticed you'll find many directress.
OK, so now let's get back to a terminal and let's see how we can see why we are why we want to see
the LDC password file.
We want to see it a password file because let's see how to open this file.
Is it easy as W.T. So when you zoom it out, you will see this file contains all the users on this particular
Web server?
Okay, so these are the part.
So when you scroll it up or down, you will find numbers of user it.
So the intention of getting this file from this Web server is to know about the user and the bot.
So from these bots, you will find lots of you'll find lots and lots of juicy data.
OK, so now let's find out how we can get this particular file using the Suara.
So now let's first.
I'll rephrase this, I'm not referencing, as you can see, that this is a barometer beach barometer
and here it is.
What it is giving it to is using gateways.
So now next thing that I'm going to do here is so let's analyze this particular thing, OK?
Where is my.
You open this again.
Do you see?
Past the bloody incident.
So when you see here what we are having, so we are having this particular thing, which is far OK.
So when you see this link, what you will find this is one directly one.
This is directed to this history.
And after this, we'll be having war and then of we are having one more day.
So totally we are having Phidippides here.
So what we need to do here is we need to get back to all of these territories and then we can XOL of
all of that, that we can simply explore the fight.
So how you can do that.
So as we all know, for Linux for getting back, we need this particular symbol.
Let me zoom it.
Okay.
Okay, okay.
Okay.
We'll be using this particular thing, Dot.
Five, 10, oh, three to five, let's try to do sometimes take seven.
Knowledge should enter so often that and you will find we are managed to get inside this file and this
is the content of this particular that we have seen in this particular shell.
So this is the same content that we are having here.
So this is how how dangerous it is.
You can simply use the warrant and you will get the file access and you you will wish you can see what
is inside it and what the content that that this particular file contains inside it.
So that is why it is very important to fix the file includes a winnability.
Well, Gigha.
So this is how you can exploit it in low settings.
OK, so before getting to the medium one, first of all, we need to see the source code so that we
can see is there any perimetral also, as you can see, there is nothing like which is filtering anything.
So you can use simply these things as you can see that it's nothing like that.
OK, so now let's simply dominated and now let's try for the medium one, OK?
So when you genzel security to medium one, OK, let's make it medium and let's see the source, ok.
There is no source.
We need to get inside filing inclusion and when you see the source.
OK, so when you see the source, what it is doing here.
This is for Louann.
I want.
For the I think security is low, will it change to medium now, medium?
Now get back to fighting close and let's call it down and let's see the.
So Norgay's.
If you see this particular thing, what it is doing here.
What it is doing here.
So what it is doing here is when you see this particular function, which is still Ripley's, it is
simply replacing these particular things into the blank spaces.
Okay, guys.
So as you can see this particular thing into the spaces, blank spaces.
So this is simply filtering something.
So now let's try to exploit some seeing winnability.
I want to get the same file using some other part window.
OK, let me erase it.
And then what I can try here, as you know, that this is what it is doing.
This is the these are simply when you don't.
But as you can see, we are managed to get inside this particular file.
So the what is the thing here?
So the thing here is when you.
When you see this, this is the fight that we have here.
So the thing here is when you see this, what they are doing here, they are filtering these spaces
that that in our case, we are having thoughts.
So these are simply we can say.
As you can see, what it is doing, the simply filtering the spaces, but in this case, we don't have
any space.
So if you want to use the single one, you can also using the money will get the file access.
OK, so this is how you can exploit it using the medium settings.
OK, so this is how you can do with the medium settings.
So if you talk about like this security height, so as we all know that this is just like impossible
to exploit this.
So when you try the same thing with this.
So let me do this like Etsy.
Blood it into somebody's head and as you can see, the file not found.
So let's get it gets back and let's see the view source and let's analyze what it is doing here.
So guess what it is doing here.
And when you see this so when you change the difficulty to high and try to exploit from the medium difficulty
and you will notice some, there is nothing working.
So surely the target is more secure.
So as it is only accepting, as you can see here, include DOT, BHB or input, starting with the word
white.
OK, so what it is doing, it is only accepting this particular thing, so if you try to if you try
to inject anything else, it will sue you at it.
OK, so this is how you can secure your website using these parameters, using these kind of filtering
so that no one can exploit your local filing bluesier.
So this is all for you all for this lecture.
I hope you understand this.
And thank you for in this lecture.