File Inclusion - TryHackMe Junior Penetration Tester 3.6

Introduction to Web Hacking, Lesson 6 - File Inclusion !
"This room introduces file inclusion vulnerabilities, including Local File Inclusion (LFI), Remote File Inclusion (RFI), and directory traversal."
Module: Introduction to Web Hacking
"Get hands-on, learn about and exploit some of the most popular web application vulnerabilities seen in the industry today."

================================================

What is TryHackMe's Jr Penetration Tester learning path?
By the end of the FREE course you will learn the necessary skills to start a career as a penetration tester which include:

Pentesting methodologies and tactics
Enumeration, exploitation and reporting
Realistic hands-on hacking exercises
Learn security tools used in the industry

#tryhackme #jrpentester #ethicalhacking =============================================================

Contents

00:00 - Intro
01:09 - Introduction
05:09 - Deploy the VM
06:25 - Path Traversal
11:59 - Local File Inclusion - LFI
17:08 - Local File Inclusion - LFI #2
28:20 - Remote File Inclusion - RFI
31:32 - Challenge - RCE in Lab #Playground
33:44 - Remediation
34:57 - Challenge

=============================================================

Music:

"1968" by TrackTribe - YouTube Audio Library License -------------------------------------------------------
"Spots Action" - by Audionautix - YouTube Audio Library License -------------------------------------------------------

Images:

[Dcrpt]

there isn't any way possible someone as a beginner can pass this room without this video.

[michaelboyd]

Great walkthrough! This room had me stumped for a long time!

[AndrewCrawford-dj]

You made it look easy but from the comments I see I wasn't the only one struggling on this one

[jamest]

Excellent video. I don’t think the content on THM has enough help for people new to computing so this is very good to give some help. This is a hard room

[sebastianwar]

Really feels like between start and end, we were missing 2-3 more learning modules.

[Cashmeister]

Thanks, this was a good learning resource you explain the concepts clearly.

[MERCURY]

Thank you so much! I was missing that command 32:20 (completely forgot about that, I was trying to access it without opening the server). This is the only walkthrough I found that solved that thing.

[motokoiwakura]

Thank you for this, so clear and concise. Your teaching style is beautiful and to the point - great educational tips and notes throughout the video, your editing was so well done... I appreciate you so much, thank you brotha! <3

[demonocrazi]

I totally love how you didn't use Burp Suite for 2nd challenge

[zszzyt]

Tip for anybody using Postman - Postman manipulates values! So server gets different value than you wanted (for example adds space between value and null byte) - instead use Curl - curl passes value as intended

[FettyHuang]

Is anyone else having problems with loading burpsuite? 38:15, I get an error message when I try to press open a browser. I fix that by allowing burp to run without a sandbox but when I turn on the burp from foxyproxy, my page cannot refresh. It's like I am disconnected from the internet when I turn on burp from foxyproxy. I did exactly what he did in the video but either some updates were made or something else cause I cannot access the burpsuite the same as this video.

[reconxf]

i dont follow at @19:35 i don't understand wdym by how php or file type to pass to the include function.

[Wuttt-sz]

I wish to see your account florish, Great Help!!

[kanchanamarindagoda]

Thanks a lot, I got stuck in this room for a long time

[rowanmurphy]

I have absolutely no idea where you're getting FoxyProxy out of Burp Suite, I did exactly what you did, and it won't even open anything. Even after I handle the error message that tells me to change a setting. Nothing happens. It just sits there like I didn't press the Open browser button. And THM did not explain almost anything in this entire module.

[Toad]

Is it just me or is this room far more confusing than the others?

[leonstone]

hey thanks! you helped me understand better and i finished on my own after the first question! edit. nvm, when i got the challenges part i crapped my pants and came back

[Richard-zwsl]

28:06 why did you do 5 ../? How do you know how many to use?

[gg]

For the challenge (lab2), that we can use the cookie to alter from Guest to admin I got on my own, and the file inclusion after you showed it could be done to the cookie. But could you explain why it is possible to alter the cookie to include the file? What triggers you to try that?

[cptvasilyzaytsev]

Great video. I have spent hours on challenge #3 going down rabbit holes. I appreciate the simplicity of the answer now haha. Is there a specific reason as to why you specified a POST method in the -d (HTTP POST data) flag?