If you are signing up for a lot of accounts you can use a disposible email. You just enter the email account you want for that second, and then you can view it. But remember, so can everyone else.
The vulnerability stems from unsanitized user-input
Here is an example of php-code vulnerable to LFI. As you can see we just pass in the url-parameter into the require-function without any sanitization. So the user can just add the path to any file.
```
# index.php
<?php
@@ -42,15 +38,16 @@ So if you an LFI you might have notices that you can read txt-files but not .php
Here you use a php-filter to convert it all into base64. So in return you get the whole page base64 encoded. Now you only need to decode it. Save the base64-text into a file and then run:
```
base64 -d savefile.php
```
### Using the nullbyte handeling .php
### Bypassing .php and other extra file-endings
THe nullbyte techniqu works in versions below php 5.3. So look out for that.
The nullbyte technique works in versions below php 5.3. So look out for that.
If the include looks like this:
@@ -64,6 +61,10 @@ If the include looks like this:
The php i added to the filename, this will mean that we will not be able to find the files we are looking for. Since the file /etc/passwd.php does not exist. However, if we add the nullbyte to the end of our attack-string the **.php** will not be taken into account. So we add **%00** to the end of our attackstring.
As noted above this wll only work for php below 5.3. So another way to deal with it is just to add a question mark.This way the stuff after gets interpreted as a paramter and therefore excluded.
Comes from here: https://gist.github.com/sckalath/a8fd4e754a72015aa0b8
Comes from here: [https://gist.github.com/sckalath/a8fd4e754a72015aa0b8](https://gist.github.com/sckalath/a8fd4e754a72015aa0b8)
/etc/mtab
/etc/inetd.conf
/var/log/dmessage
#### Web server files
```
# Usually found in the root of the website
.htaccess
@@ -117,6 +117,7 @@ config.php
```
#### SSH
```
authorized_keys
id_rsa
@@ -124,7 +125,9 @@ id_rsa.keystore
id_rsa.pub
known_hosts
```
#### Logs
```
/etc/httpd/logs/acces_log
/etc/httpd/logs/error_log
@@ -142,6 +145,7 @@ known_hosts
#### General files
First you need to check the passwd file to find the users.
```
cat /etc/passwd
cat /etc/group
@@ -163,9 +167,10 @@ Found in the home-directory
"Under Linux, /proc includes a directory for each running process, including kernel processes, in directories named /proc/PID, where PID is the process number. Each directory contains information about one process, including: /proc/PID/cmdline, the command that originally started the process."
