Our guest now in this, we will see local for inclusion to the market execution.
So first, let's discuss what is a fight that there is no call for inclusion.
OK, I suppose I have this file.
It contains some text.
So what take do.
So this is a thing as a Web page.
So this Web page contains this content.
So this is another webpage now instead of copying all these lines.
Now, what I can do is I can say include I've said this filename is, uh, Beezy Lati.
OK, now this function takes this parameter p0 and go to this piece erotics you to this one and copies
are the content and pasted in here.
So this will not be directly it will render, uh, when we open this up.
So that means this longer file has been included in this webpage.
Now instead of this particular DHT, what we can say, we can also get the possibility for.
So it's fresh out of sight, so you can also get a configuration file also.
So that means these include function should be filtered.
If that did not feel that you can get information, disclosure.
So that means this actual function should be filled.
So here is an example.
So this is the, uh, file parameter.
So we need to send the file parameter in new order and it'll be stored in the file available.
So you set to file so the variable is not null and we are including this file contents.
So so we can say attacker dot com which mark.
And five seconds to be sealed, so this will be the string of this file and then the disenthrall will
copy the content of this piece composite here instead of this piece to what I can do is I can say it's
see, possibly.
So you can get the contents of this possibly into this.
So this is a vulnerability for inclusion.
Now we are going to discuss the next mission I am bringing up as part of our mission here and I have
already done that and Metzker.
So this is an Majken and but there are so many polls open, so one of the parties at Observer economist
David.
And if you the conditions are admin and the password, and if you click on this file inclusion, you
can see tancred a file, edit the page is already used.
Include that page picture this.
What we can do is.
It's he paused and he did, and you can see the contents of possibility for you to can search for any
uses which does not have any password.
Again, I'll refresh this.
So first, let's see the source code.
So this is a very simple get page and then, uh, storing it in a favorable sometimes here, uh, what
it will be is, uh, it will happen.
The BHP extensional.
So this will be for these girls to get that BHP that means whatever you include here, and another BHP
Shrem will be appended here and then, uh, it will be stored in the file.
So if you put the C possibility.
So this, uh, source code will add BHP at the end and it will send to the, uh, Renderos.
So that means you cannot fix the passably.
So one thing you can bypass is you can put the character here.
So percentage Strache percentage.
So there is another Terminator and whenever, uh, this opening has been taking place, it will get
truncated because of this Marguerita.
So this, uh, percentage Ruggiero, uh, plus this one, this person, the of Terminator, like BHP
externship.
No, he didn't.
So you can see similar output.
In our case, there is no apparent explanation that we can simply said t possibility.
And sometimes you need to go back to the Paternot.
That is far from the territory because this, uh, uh, included BHP maybe in the summer in South Florida.
So you make sure you have sufficient updated so that you read the raw data and then you can request
for it.
See, possibly so you can see the same output.
So this is the basic information disclosure, and you can also see shadow, you can also give permission.
OK.
This some.
So.
I'm sorry.
OK, permission denied.
Um, you can get for some varies depending upon the, uh, security permissions.
OK, this is the basic roll for inclusion, know how to convert this into the remote code execution
is due to the rock poisoning.
So when we're using the environment variables, proc self-insurance, OK, distorts the ah, the environment
where was required by the browser server server.
What we can do is we can set up.
Self and we.
And so you can see here, you can see the rhetoric, shtetls and HTP and course that is our IP address,
it should be user, that is Firefox, but you are Bergonzi, cookies, S.A.G., etc. So these will be
stored in the cell phone.
OK, now what we can do is I'm turning the Sudan.
Proxy Perceptron and good end of this --.
So now we are sending the.
OK, now what?
I want to send it to Peter.
So let's turn this into sort of show here.
What we can do is let's send and get the result.
So these are the environment.
Where are right now?
We can change this region.
So use the region to execute some BHB system of.
Underscored that get tough with Jesse.
So let's send this.
And you can see HDB user agent is equal to nothing because this is a BHP picture and it is, uh, cannot
be seen in the normal.
Hegde You know what we is, however, this will be discussed, is definitely included in this to prove
that you can send the value of CE here.
So this is the get of see and you can see the value of SI as he is equals to address and now xanthan.
I think you can see this is the output in crude, that BHP index for BHP and the source so might be
there.
So this is output.
Now, what we can do is you can start.
It is not.
So I'm listening on this one, two, three, four, four, now go to Decoder and.
You can see and see and we and I appeared.
These are my colleagues, IP address and post, one, two, three, four, chariot's.
Let's see.
I'm sorry, it's 4:00 and then upon execution, excuse this big bash, so you need to send this.
You are and so you can encoders, you are so cocky this.
And go to Jupiter and based of evidence.
So if you're going in the browser in the right order, you don't need to and you can try to send the
net controversial, but you need to.
No, sir, we do not get response because the researcher has been executer and see correction from Hegan.
There we are right there.
Unless you can see the same output we have seen in the previous packet.
So you can upgrade to the previous Shell and do some Linux Proscar something.
So let me close this.
So this is one we're using the.
So this is one way to exploit this environment, which was so we are.
So this is the easy not in this environment variables, so the next one is either Diggnation poisoning.
So where are the Dutrow now?
Let's go and see.
Where blog?
Do not drop, so the is it unlocks, so whenever you switch on your system, is that any username and
password, it will belong to the virtual items also.
So now what we can do is, as I said, instead of as a user, you can take this BHP, CAMAC, so get
the same we have used in that environment was poisoning.
So instead of this normal user name, you can send this one now hit, enter the password, type something.
Bravo and exit.
Now refresh this page.
It's also.
That's sort of again.
Sent to repeat the support of so no, I don't actually assure you with a normal user.
This is it.
Let's put it.
It's a great idea.
I don't know, password Hidari.
No, across this weekend, no request for this WLOX, son.
No, you can search for Rican.
So you can see in the user from the IP address.
So this is my car, looks like it has failed and also my IP address and user name has been locked.
So in the same way, the previous request, this BHP has been over.
Now, what you can do is you can simply.
Sir.
Send us here, because this this will already be rendered by the BHP and you need to supply them.
Come on, that's a loss.
I don't think you can see that.
Let's hear.
OK, I don't know, there is so much book you can see here, this is but help that page be next page.
I'll output is.
A shooting incident, this user, so we have this user has been repeating a few times in the few and
so that user name, this output has been discovered, output has been placed.
You can see here the file names.
So if you delete this, you can normalize.
You invited a user protector from this IP address.
So now you can simply go to the decoder and copy the same.
And pasted in here, it should offer this similary.
A new Trenta, sorry, sorry, not underage, and so now you can see correction from this idealist's.
So let's close this one.
So this one technique, if you will, phone if you find this, uh, is is it a porcupine?
You can see her as a of Port-Au-Prince.
You can use the poison poisoning.
You can buy those rocks and also if logs.
So why don't we yes, FPP or.
OK, permission denied.
So this log, we cannot open this log because the permission has been denied.
So.
So if there is a permission access, so what we can do is you can say FPP.
So I'm not into the safety of this username on let's compare this, so let's copy and pasted in here
so it will be logged into the server and to browse around and you can see it.
So now you can normally refresh this page and send, uh, uh, Ampersands Colston's, you're not controversial.
So in our case, the permission has been denied.
OK, so the next one is mail double available data.
So generally there isn't some tippity server.
So this is unquantified.
Yes.
So there the file structure is different for this metastable two.
And generally memories are stored that were mail user.
So generally the user name will be doubled over the data.
So you can send this, you know, medicament using this mail subject instead of this subject, you can
send this PSP system command.
And after that, you can just go to the user and go to this e-mail where username C and so you can also
see if we as a people.
OK.
You can also do the Web log.
Apache to Apache to you to access that rock so you can similary, you can generate a fake request and
get index leader BHP, you can get that question about this system so you can send that and that will
be logged into this access so you can simply share ampersand seeds equals to your Chalco.
So simple.
But in our case, we have we do not have access to this access bartrop.
So you can use this Apache axis of evil axis and then you can use is a Pipistrelle and many more.
So that's how you do the, uh, you use the these poisoning methods to take advantage of this struggle
for inclusion and to get the reverse.