LFI – PETIR CYBER SECURITY

http://natas6.natas.labs.overthewire.org/ username : natas6 password : aGoY4q2Dc6MgDq4oL4YtoKtyAg9PeHa1 Tampilan pertama halaman web adalah seperti dibawah ini Terdapat sebuah field untuk memasukkan input dan link untuk menuju source codenya di http://natas6.natas.labs.overthewire.org/index-source.html

 <html>
<head>
<!-- This stuff in the header has nothing to do with the level -->
<link rel="stylesheet" type="text/css" href="http://natas.labs.overthewire.org/css/level.css">
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/jquery-ui.css" />
<link rel="stylesheet" href="http://natas.labs.overthewire.org/css/wechall.css" />
<script src="http://natas.labs.overthewire.org/js/jquery-1.9.1.js"></script>
<script src="http://natas.labs.overthewire.org/js/jquery-ui.js"></script>
<script src=http://natas.labs.overthewire.org/js/wechall-data.js></script><script src="http://natas.labs.overthewire.org/js/wechall.js"></script>
<script>var wechallinfo = { "level": "natas6", "pass": "<censored>" };</script></head>
<body>
<h1>natas6</h1>
<div id="content">

<?

include "includes/secret.inc";

    if(array_key_exists("submit", $_POST)) {
        if($secret == $_POST['secret']) {
        print "Access granted. The password for natas7 is <censored>";
    } else {
        print "Wrong secret";
    }
    }
?>

<form method=post>
Input secret: <input name=secret><br>
<input type=submit name=submit>
</form>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>
</div>
</body>
</html>

<html>

<head>

<body>

<h1>natas6</h1>

include "includes/secret.inc";

if(array_key_exists("submit", $_POST)) {

if($secret == $_POST['secret']) {

print "Access granted. The password for natas7 is <censored>";

} else {

print "Wrong secret";

}

Input secret: <input name=secret><br>

</form>

<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>

</div>

</body>

</html>

Ditengah terdapat sebuah code php yang akan saya jelaskan, pertama codenya melakukan include sebuah file di folder includes bernama secret.inc , kemudian melakukan pengecekan jika input sudah […]

Tag: LFI

[TJCTF 2020] – File Viewer

[Overthewire] – Natas6,7,8

[TIKAD CTF 2018]: Situs Yang Bocor

Protected: [CTFS.ME]: Blue Eyes