PHP brute-force Path Method

1. The single quotation mark (single quotation mark) is directly added to the URL. The single quotation mark is not filtered (GPC = OFF) and the server returns an error message by default. Www.xxx.com/news. php? Id = 149 '2. Change the parameter value to be submitted in the path of the error parameter value to an error value, for example,-1. Try to filter out single quotes. Www.xxx.com/researcharchive. php? Id =-1 3. Search for the webpage snapshot of the Error Page Based on the keyword and site syntax in Google burst path. Common keywords include warning and fatal error. Note: If the target site is a second-level domain name, the site is connected to its corresponding top-level domain name, resulting in much more information. Site: 2cto.com WARNING Site: 2cto.com "Fatal error" 4. Test File explosion path many websites have test files and scripts in the root directory. Code Usually phpinfo (). Www.xxx.com/test. PHP www.xxx.com/Ceshi. PHP www.xxx.com/info. PHP www.xxx.com phpinfo. PHP www.xxx.com/php_info.php www.xxx.com/1.php 5. Once you find the phpMyAdmin Management page and access some specific files in the directory, the physical path may pop up. For phpMyAdmin addresses, you can use tools such as wwwscan or Google. PS: Some BT websites are written as phpMyAdmin. Www.xxx.com/PHPmyAdmin/themes/darkblue_orange/layout. Inc. php www.xxx.com/PHPmyAdmin/libraries/select_lang.lib.php www.xxx.com/PHPmyAdmin/index. php? Lang [] = 1 6. Find the path of the configuration file. If the injection point has the file read permission, you can manually load_file or use a tool to read the configuration file, then, find the path information (usually at the end of the file ). The default paths of web servers and PHP configuration files on various platforms can be checked online. Windows: C: \ WINDOWS \ PHP. ini php configuration file c: \ windows \ system32 \ inetsrv \ metabase. xml iis virtual host configuration file Linux:/etc/PHP. ini php configuration file/etc/httpd/CONF. d/PHP. conf/etc/httpd/CONF/httpd. conf Apache configuration file/usr/local/Apache/CONF/httpd. conf/usr/local/apache2/CONF/httpd. conf/usr/local/Apache/CONF/extra/httpd-vhosts.conf virtual directory configuration file 7, nginx file type error parsing burst path this was accidentally found yesterday, of course, the web server is required to nginx, the file type parsing vulnerability exists. Sometimes/X. php is added after the image address. This image will not only be executed as a PHP file, but may also expose the physical path. Www.xxx.com/top.jpg/X. php 8. Other websites are like dedecms and phpwind.Program Path-breaking vulnerabilities are complex and less universal.