Hacking Websites by Uploading files (With symlinks)

In this video, I show you how symlinks can be used to read arbitrary files on a web server.

DISCLAIMER: This video is intended only for educational purposes.
The experiments in this video are performed in a controlled
lab setup and not on a live target. The content is purely
from a penetration testing perspective. I do not
condone or encourage any illegal activities.

The web application in the video supports a file upload functionality where users can upload zip files. When we create a zip file that has a symlink in it which is pointing to an arbitrary file on the server, we are able to read the file pointed by the symlink. In this way we can read any file on the server which can be read by the web server user account (www-data). This can be used to read sensitive files like private keys, bash history, and even apache configuration files. We can leverage this vulnerability to read environment variables that the website is using and find interesting information like Database credentials, tokens, secret strings which we can further use to gain access to various services like ftp, ssh, database, etc.

Thanks for watching!
SUBSCRIBE for more videos!

[schooldropout]

Is finding a way to upload files without following the usual restrictions considered a security problem?

Yes, bypassing file upload restrictions is a security vulnerability because it can potentially allow malicious files to be uploaded to a system, which can lead to various security risks and issues.

[anudeepkalyadapu]

What a video ! Looking forward for such videos man! Keep it up

[_SebJ]

It's intresting to learn that they place the password in an environment variable, wonder if most devs encrypt it as well. As that might be the slightest bit more secure.

[dishusharma]

Where did you learn to pronounce environment as enveeronment? I am curious.

[Nin_Cada]

So what is the counter of it? How to not let the hackers get access to the filesystem using symlincks?

[TheAKAnonymous]

a suggestion,
maybe you should try different titles something special surprising to be able to get more views adding curiosity to new students i mean we are technical student we understand your titles but new students might not
and last thing as always this was a awesome video

your's
TheAKAnonymous

[SankalpaBaral]

Brother do you remember you used to create challenges (like CTF)? Please make those types of videos again.

[montala]

Hi brother, the symlink is only work when target site use ZIP/ TAR. How about normal upload file? can I upload that symlink file to retrieve the content?

[pinged]

Does this affect sites that do not do anything with the file, just purely serve it? I have a pretty basic file hosting service thats public, do I need to somehow worry about this? Symlinks are not something that can be POSTed over HTTPS, right?

[manishneupane]

Wow, great video.
Thank you for making

[anuzravat]

is there some related article for this symlink vuln, u would like to recommend

[monsterzero]

Can you please make a video on burpsuite how to inject files on servers by changing the file extension and injecting a backdoor with that

[rajeevpuri]

thank you Sir, for this easy to understandable video for a noob like me.🙏🙏

[Sinne]

Is there any way to recreate this vulnerability, I wanna try and test it out
If yes someone point me to it please

[Sinne]

where to get this source file of the one you doing right now,

[Tankbuild-ti]

you can also direct it make a zip file that contains backdoor shell (shell.php)

[SwineTech]

Daemon, a program that runs in the background, anyone noticed the daemon

[gowthamreddysomala]

Anna nee Videos Kosam Wait Chastunnam ..

[ReligionAndMaterialismDebunked]

:3 I wonder if this can be used on my bug bounty targets. Also, I'm wondering how many Iranian, Lebanon, Saudi Arabian, North Korea, China, and other sites of terrorist, and dictatorship nations I get can into. 😅🥰🤑😋🤤

Great Indian hacker video. English. :3 😅 Shalom. Namaste.