当前位置:网站首页>基於DVWA的文件上傳漏洞測試
基於DVWA的文件上傳漏洞測試
2022-07-06 01:07:00 【wishLifeJumP】
目錄
DVWA
Low
DVWA Security的“low”級別可以直接上傳“一句話”木馬。
1.1 編寫測試木馬
<?php
phpinfo();
?>
1.2 沒有後綴過濾直接上傳
1.3回顯上傳路徑,直接訪問即可
http://localhost/dvwa/hackable/uploads/info.php
Medium
Medium級別不同於Low級別,Medium界別對前端做了上傳限制,通過繞過檢測機制,抓包更改後綴名達到上傳效果。
2.1 上傳合法文件,此時打開代理
2.2 待抓到數據包後,send to repeater
info.png 改為info.php
響應碼為200說明書上傳成功。
2.3 執行php脚本
https://localhost/dvwa/hackable/uploads/info.php
边栏推荐
- Four commonly used techniques for anti aliasing
- Idea remotely submits spark tasks to the yarn cluster
- Cf:h. maximum and [bit operation practice + K operations + maximum and]
- VSphere implements virtual machine migration
- Four dimensional matrix, flip (including mirror image), rotation, world coordinates and local coordinates
- Why can't mathematics give machine consciousness
- Promise
- servlet(1)
- 毕设-基于SSM高校学生社团管理系统
- Intensive learning weekly, issue 52: depth cuprl, distspectrl & double deep q-network
猜你喜欢
The population logic of the request to read product data on the sap Spartacus home page
282. Stone consolidation (interval DP)
For a deadline, the IT fellow graduated from Tsinghua suddenly died on the toilet
Keepalive component cache does not take effect
After 95, the CV engineer posted the payroll and made up this. It's really fragrant
Fibonacci number
[groovy] XML serialization (use markupbuilder to generate XML data | set XML tag content | set XML tag attributes)
Xunrui CMS plug-in automatically collects fake original free plug-ins
Some features of ECMAScript
[groovy] compile time meta programming (compile time method interception | method interception in myasttransformation visit method)
随机推荐
cf:C. The Third Problem【关于排列这件事】
Some features of ECMAScript
[groovy] compile time metaprogramming (compile time method interception | find the method to be intercepted in the myasttransformation visit method)
直播系统代码,自定义软键盘样式:字母、数字、标点三种切换
golang mqtt/stomp/nats/amqp
Live broadcast system code, custom soft keyboard style: three kinds of switching: letters, numbers and punctuation
2020.2.13
VSphere implements virtual machine migration
STM32 key chattering elimination - entry state machine thinking
MCU realizes OTA online upgrade process through UART
Lone brave man
可恢复保险丝特性测试
Live video source code, realize local storage of search history
[pat (basic level) practice] - [simple mathematics] 1062 simplest fraction
Cf:c. the third problem
KDD 2022 | 脑电AI助力癫痫疾病诊断
图解网络:TCP三次握手背后的原理,为啥两次握手不可以?
Introduction to robotics I. spatial transformation (1) posture, transformation
cf:D. Insert a Progression【关于数组中的插入 + 绝对值的性质 + 贪心一头一尾最值】
Kotlin core programming - algebraic data types and pattern matching (3)