Add files via upload

ewilded · Mar 27, 2018 · 344eee3 · 344eee3
1 parent a53313d
commit 344eee3
Show file tree

Hide file tree

Showing 10 changed files with 72 additions and 23 deletions.
diff --git a/test_cases/LFI/eight.php b/test_cases/LFI/eight.php
@@ -0,0 +1,11 @@
+<?php
+$fname=$_GET['file'].".txt";
+
+## this one's recurrent and expected to fail when dealing with mix of no-encoding+double encoding (with only nix slashes in use)
+
+$fnames=explode(" ",$fname);
+foreach($fnames as $f)
+{
+	echo file_get_contents("../".$fname);
+}
+?>
diff --git a/test_cases/LFI/eleven.php b/test_cases/LFI/eleven.php
@@ -0,0 +1,11 @@
+<?php
+
+if(isset($_GET['file']))
+{
+	$file=str_replace('../','',$_GET['file']);
+	$file=str_replace('./','',$file);
+	echo @file_get_contents('./'.$file);
+}
+#removing ../ then ./
+?>
+
diff --git a/test_cases/LFI/five.php b/test_cases/LFI/five.php
@@ -0,0 +1,6 @@
+<?php
+$fname=$_GET['file'];
+$fname=str_replace('../','',$fname);
+$fname=urldecode($fname);
+echo file_get_contents("./".$fname);
+?>
diff --git a/test_cases/LFI/four.php b/test_cases/LFI/four.php
@@ -1,11 +1,6 @@
 <?php
-
-if(isset($_GET['file']))
-{
-	$file=str_replace('..','',$_GET['file']);
-	$file=str_replace(' ','',$file); // removing white spaces
-	echo @file_get_contents('./'.$file);
-}
-#removing .. then white spaces
+$fname=$_GET['file'];
+$fname=str_replace('../','',$fname);
+$fname=str_replace("..\\",'',$fname);
+echo file_get_contents("./".$fname);
 ?>
-
diff --git a/test_cases/LFI/nine.php b/test_cases/LFI/nine.php
@@ -0,0 +1,11 @@
+<?php
+
+if(isset($_GET['file']))
+{
+	$file=str_replace('..','',$_GET['file']);
+	$file=str_replace(' ','',$file); // removing white spaces
+	echo @file_get_contents('./'.$file);
+}
+#removing .. then white spaces
+?>
+
diff --git a/test_cases/LFI/one.php b/test_cases/LFI/one.php
@@ -1,9 +1,4 @@
 <?php
-
-if(isset($_GET['file']))
-{
-	$file=str_replace('../','',$_GET['file']);
-	echo @file_get_contents('./'.$file);
-}
-#removing only ../
+$fname=$_GET['file'];
+echo file_get_contents("./".$fname);
 ?>
diff --git a/test_cases/LFI/seven.php b/test_cases/LFI/seven.php
@@ -0,0 +1,11 @@
+<?php
+$fname=$_GET['file'];
+
+## this one's recurrent and expected to fail when dealing with mix of no-encoding+double encoding (with only nix slashes in use)
+while(stripos($fname,"../"!=FALSE))
+{
+	$fname=str_replace('../','',$fname);
+}
+$fname=urldecode($fname);
+echo file_get_contents('./'.$fname);
+?>
diff --git a/test_cases/LFI/six.php b/test_cases/LFI/six.php
@@ -0,0 +1,7 @@
+<?php
+$fname=$_GET['file'];
+
+$fname=str_replace('./','',$fname);
+$fname=urldecode($fname);
+echo file_get_contents("./".$fname);
+?>
diff --git a/test_cases/LFI/ten.php b/test_cases/LFI/ten.php
@@ -0,0 +1,6 @@
+<?php
+$fname=$_GET['file'];
+$fname=str_replace('..','',$fname);
+$fname=urldecode($fname);
+echo file_get_contents("./".$fname);
+?>
diff --git a/test_cases/LFI/three.php b/test_cases/LFI/three.php
@@ -1,10 +1,6 @@
 <?php
+$fname=$_GET['file'];
+$fname=str_replace('../','',$fname);
 
-if(isset($_GET['file']))
-{
-	$file=str_replace('../','',$_GET['file']);
-	$file=str_replace('./','',$file);
-	echo @file_get_contents('./'.$file);
-}
-#removing ../ then ./
+echo file_get_contents("./".$fname);
 ?>