And this lecture, we're going to have a look on file upload vulnerabilities, these are the simplest
type of vulnerabilities because they allow us to upload any type of file.
So, for example, of the target computer can understand, then we can upload any file or a shell and
get full control over the target computer.
Now, is the target computer or the target server understands Python or any other language, then you
can just upload Python Code, Python Shell or Ruby Shell.
You can create these shell using Relevation or Mehta's Floyd or you can use your own PHP or Python Shell.
What we're going to do today, we're going to have a look on a tool called Wavelet that generates shells
and allow us to gain access and do a number of cool things on the target computer.
So, first of all, I have my EDV here.
And usually when you're trying to test a website, what I recommend is before trying to use any tools
or anything, after you do your information gathering, as you just go in and try to browse the websites,
you see what you can see, just get a feel of the website, see what's installed on it and all that,
and try to exploit any features you see.
So, for example, let's say you went on everything and then you reached the upload.
We can see that this website allow us to upload a file.
Now this sometimes in in your penetration testing tasks, it could be a website that allows you to upload
a profile picture a picture.
If it's a classified website, maybe it's allowing you to upload pictures of cars or whatever you're
trying to add in the website.
So as you can see here, the website expects you to choose an image and upload an image, so let's see
if we can upload an image first.
So I'm going to go on my downloads and I have a picture here in the resources.
Just a picture of a car, I'm going to upload it and see if it gets uploaded.
And we can see that the upload was successful and it's stored in this particular location, so it's
dot, dot, dot, dot, which is which means two directories back and then this file name.
So let's see if we can if the picture has actually been uploaded.
So I'm taking away two directories and taking away the vulnerabilities and upload.
I'm only using that.
And then we're going to get this location on the server just to see if the picture was uploaded properly.
And as you can see, the picture has been uploaded, so that's all good.
Now, the next thing we want to do, let's try and upload a file, and to do that, we're going to use
a tool called Waveney, as I said, to create a payload or a shell if you go if you want to call it.
And it's obviously going to be a threshold you can use bittersweet, as I said, to create a payload.
But we're going to be just having a look on a different tool that's designed for Web application penetration
testing.
So it is very easy, we're going to.
Put the towel name, which is wavelet, and then we're going to put generate.
Because we want to generate a payload or a shell file, then we will put a password for that file so
that all the US can access it and control the website when we upload it to the website.
So my password is going to be one, two, three, four, five, six.
And then I'm going to say what I want to store it and I want to store it in route and I'm going to call
it show that BHP.
So very simple, Waverly is the name of the program generated to generate a shell, the password that
the shell is going to authenticators with and it's going to be stored in Shell Dogpatch, we're going
to hit Enter and it's created now.
If I am already in my roots or if I just do this, I should see it.
And we can see it right here, so the next thing is we're just going to go back to our website and try
to upload that show.
And I'm going to look for a show, and here it is.
Going ahead on upload.
And as you can see now, it's telling me the file has been uploaded successfully and it's in the same
place that the picture was.
So all we need to do now is we're going to use the same link and we're going to use Whibley again to
interact with that show that we uploaded.
Now, let's, first of all, see if the show exists and it's been uploaded properly.
So I'm just going to browse through my browser.
Childhood, BHP, and you can see that you get a blank page, so we're not getting four for file not
found, which means that the file has been uploaded and it's there.
So we're going to try to interact with it from wavelet to connect to it.
We're going to type in Evelia.
And then we're going to put the URL where the shell is.
So this is where our shell has been uploaded and then we're going to put the password to my password
was one, two, three, four, five, six.
Very simple.
Whibley The URL where the file is, and one, two, three, four, five, six.
This is very simple, as similar to when you use your multi handler waiting for connections are connected
to your back door.
So we're literally just going to connect the back there that we uploaded.
And as you can see in our in the file system.
So from we believe from this place, you can actually just type in Anula next command and you'll be
able it will be executed on the target computer and you'll see the result here.
So if I do a W.D., you'll see that I'm inva w w w hackable uploads.
And if I do an idea.
I'll see my user at the moment, which is the data, and if you do.
A you name, I just confirmed that this is the Middle East floatable machine, you'll see that this
is the next test portable machine and now it can do anything we want.
We can list the files.
We can navigate.
You can do any command that you want to do.
Now, we have changed.
Our place has been changed.
We also offers much more features than just this.
So it actually allows you to do a number of cool things.
If you type in help, you'll see all the cool stuff that you can do with Waverly so you can try to escalate
your privileges.
As execute scale queries and a lot of cool stuff that is just designed for Web application penetration
testing for now, I'm going to leave it at this and this just shows you how to use a file upload variabilities.