filetype:php inurl:"viewfile" -"index.php" -"idfil

  • 日期:2004-06-16
  • 类别:
  • 作者:anonymous
  • 语法:filetype:php inurl:"viewfile" -"index.php" -"idfil
  • Programmers do strange things sometimes and forget about security. This search is the perfect example. These php scripts are written for viewing files in the web directory (e.g. --> will show you the my_howto.txt).An attacker can check for buggy php scripts wich allow you to view any file on the system (with webservers permissions). Try the good, old directory traversal trick: "../../../". You have to know the filename and location, but that's not a big problem (/etc/passwd anyone ?).