And this lecture we're going to have a look on file upload vulnerabilities.
These are the simplest type of vulnerabilities because they allow us to upload any type of file.
So for example of the tablet computer can understand we then we can upload any ph profile on a page
reshelve and get full control over the target computer.
Now as the target computer or the target server understands Python or any other language then you can
just upload Python code in python shell or Ruby shell you can create the shell use in evasion or meta
exploit or you can use your own Ph.D. or python shell.
What we're going to do today we're going to have a lock on a tool called Wheatly that generates ph Rochelle's
and allow us to gain access and do a number of cool things on the target computer.
So first of all I have my DVD with you here.
And usually when you're trying to paint us a Web site what I recommend is before trying to use any tools
or anything after you do your information gathering is you just go in and try to browse the web sites
you see what you can see just get a feel of the Web site see what's installed on it and all that and
try to exploit any features you see.
So for example let's say you went on everything and then you reach the upload.
We can see that this Web site allows us to upload a file.
Now this sometimes in in your penetration testing tasks it could be a Web site that allow you to upload
a profile picture a picture if it's a classified website maybe it will allow you to upload pictures
of cars or whatever you're trying to add in the web site.
So as you can see here the Web site expects you to choose an image and upload an image.
So let's see if we can upload an image first.
So I'm going to go on my downloads and I have a picture here and the resources just a picture of my
car.
I'm going to upload it and see if it gets uploaded.
And you can see that the upload was successful and it started in this particular location.
So it's dot dot dot dot which is which means two directories back.
And then this filename.
So let's see if we can if the picture has actually been uploaded.
So I'm taking away two directories and taking away the vulnerabilities and upload.
I want to use that.
And then we're going to get this location on the server just to see if the picture was uploaded properly.
And as you can see the picture has been uploaded so that's all good.
Now the next thing I do let's try and upload a PH pre-fall and to do that we're going to use a tool
called we've as I said to create a payload or a shell if you go if you want to call it.
And it's obviously it's going to be a PH reshelve you can use with us voice.
As I said to create a APHC payload.
But we're going to be just having a look on a different tool that's designed for web application penetration
testing so the tool is very easy.
We're going to put the tool name which is we've.
And then we're going to put generate because we want to generate a pay note or a shell file then we
will put a password for that file so that only US can access it and control the website when we upload
it to the website.
So my password is going to be one two three four five six and then I'm going to say what I want to store
it and you want to store it in route and I'm going to call it Shell ph free so very simple really is
the name of the program generators to generate a show the password that the show is going to authenticate
us with and it's going to be stored in road Shelder ph we're going to hit enter and created.
Now if I I'm already in my roots or if I just do LS I should see it and we can see it right here.
So the next thing is we're just going to go back to our website and try to upload that show
and I'm going to look for a show.
And here it is going to upload
and as you can see now tell me the file has been uploaded successfully and it's in the same place that
the picture was.
So all you need to do now is we're going to use the same link and we're going to use really again to
interact with that show that we uploaded.
Now let's first of all see if the shell exists and it's been uploaded properly.
So I'm just going to browse through my browser J-Lo's page.
And you can see that you get a blank page so we're not getting four or four file not found.
Which means that the file has been uploaded and there.
So we're going to try to interact with it from to connect to it.
We're going to type in really and then we're going to put the R L where the shell is.
So this is where our shell has been uploaded and then God put the password or my password was 1 2 3
4 5 6.
Very simple really.
The L Word the file is 1 2 3 4 5 6.
This is very simple.
Is similar to when you use your multi-hundred waiting for connections or connected to your banker.
So we're literally just going to connect to the back there that we uploaded.
And as you can see now we're in the file system.
So from what you've read from this place you can actually just type in any Linux command and you'll
be able it will be executed on the target computer and you'll see the result here.
So if I do OPW the you'll see them that I'm invited w WW hackable uploads.
And if I do an ID I'll see my user at the moment which is the readably data.
And if you do you name a just to confirm that this is the meter's notable machine.
You'll see that this is the Linux with exploitable machine.
Now we can do anything we want we can this the files we can navigate.
You can do any linux command that you want to do.
Now we have change our pace has been changed.
We also offer as much more features than just this.
So it actually allows you to do a number of things if you type in help.
You'll see all the cool stuff that you can do with.
So you can try to escalate your privileges as execute as queries and a lot of cool stuff that is just
designed for web application penetration testing.
For now I'm going to leave it at this and this just shows you how to use a file upload variabilities.