Skip to content

small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns

License

Notifications You must be signed in to change notification settings

paralax/lfi-labs

Repository files navigation

lfi-labs

small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns

why?

for training and testing purposes. you can test detection products (e.g. vulnerability scanners), exploit tools, etc.

these are NOT intended for evaluating appsec testing tools.

the idea is that you'd add these to an Apache VirtualHost directive for testing purposes. if you need to do some quick and dirty testing, fire up php -S 0.0.0.0:8080 or something and go to town.

how?

three big options.

  1. UN*X + Apache + PHP, install lfi-labs under somewhere and get to work.
  2. run a Docker instance using the Dockerfile. docker-compose up
  3. run a Vagrant instance using the Vagrantfile. vagrant up

who?

jose nazario @jnazario

inspired by

https://github.com/AUDI-1/sqli-labs

useful links

LFI/RFI/CMD injection background

walkthrough

About

small set of PHP scripts to practice exploiting LFI, RFI and CMD injection vulns

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published