当前位置：网站首页>基於DVWA的文件上傳漏洞測試
基於DVWA的文件上傳漏洞測試
2022-07-06 01:07:00 【wishLifeJumP】
目錄
DVWA
Low
DVWA Security的“low”級別可以直接上傳“一句話”木馬。
1.1 編寫測試木馬
<?php
phpinfo();
?>1.2 沒有後綴過濾直接上傳
1.3回顯上傳路徑，直接訪問即可
http://localhost/dvwa/hackable/uploads/info.php
Medium
Medium級別不同於Low級別，Medium界別對前端做了上傳限制，通過繞過檢測機制，抓包更改後綴名達到上傳效果。
2.1 上傳合法文件，此時打開代理
2.2 待抓到數據包後，send to repeater
info.png 改為info.php
響應碼為200說明書上傳成功。
2.3 執行php脚本
https://localhost/dvwa/hackable/uploads/info.php
边栏推荐
- Gartner released the prediction of eight major network security trends from 2022 to 2023. Zero trust is the starting point and regulations cover a wider range
- For a deadline, the IT fellow graduated from Tsinghua suddenly died on the toilet
- Idea remotely submits spark tasks to the yarn cluster
- [groovy] JSON serialization (convert class objects to JSON strings | convert using jsonbuilder | convert using jsonoutput | format JSON strings for output)
- Leetcode 44 Wildcard matching (2022.02.13)
- Use of crawler manual 02 requests
- MYSQL---查询成绩为前5名的学生
- WordPress collection plug-in automatically collects fake original free plug-ins
- [simple implementation of file IO]
- ADS-NPU芯片架构设计的五大挑战
猜你喜欢
How to extract MP3 audio from MP4 video files?
关于softmax函数的见解
Differences between standard library functions and operators
![Cf:d. insert a progression [about the insert in the array + the nature of absolute value + greedy top-down]](/img/9e/c933f454a39d906a407e4d415f0b87.png)
Cf:d. insert a progression [about the insert in the array + the nature of absolute value + greedy top-down]
WordPress collection plug-in automatically collects fake original free plug-ins
![[groovy] JSON string deserialization (use jsonslurper to deserialize JSON strings | construct related classes according to the map set)](/img/bf/18ef41a8f30523b7ce57d03f93892f.jpg)
[groovy] JSON string deserialization (use jsonslurper to deserialize JSON strings | construct related classes according to the map set)
Browser reflow and redraw
![[groovy] JSON serialization (jsonbuilder builder | generates JSON string with root node name | generates JSON string without root node name)](/img/dd/bffe27b04d830d70f30df95a82b3d2.jpg)
[groovy] JSON serialization (jsonbuilder builder | generates JSON string with root node name | generates JSON string without root node name)
Folding and sinking sand -- weekly record of ETF
Dedecms plug-in free SEO plug-in summary
随机推荐
视频直播源码，实现本地存储搜索历史记录
JMeter BeanShell的基本用法 一下语法只能在beanshell中使用
How to make your own robot
Spark DF adds a column
从 1.5 开始搭建一个微服务框架——调用链追踪 traceId
The population logic of the request to read product data on the sap Spartacus home page
BiShe - College Student Association Management System Based on SSM
Logstash clear sincedb_ Path upload records and retransmit log data
Curlpost PHP
C language programming (Chapter 6 functions)
Redis' cache penetration, cache breakdown, cache avalanche
Recursive method to realize the insertion operation in binary search tree
Idea remotely submits spark tasks to the yarn cluster
[groovy] compile time metaprogramming (compile time method injection | method injection using buildfromspec, buildfromstring, buildfromcode)
282. Stone consolidation (interval DP)
Xunrui CMS plug-in automatically collects fake original free plug-ins
The growth path of test / development programmers, the problem of thinking about the overall situation
ADS-NPU芯片架构设计的五大挑战
Four commonly used techniques for anti aliasing
View class diagram in idea