Beranda › Forums › Mempelajari Teknik Hacking Tingkat Menengah › Local File Inclusion (LFI)
Tagged: LFI
- This topic has 10 replies, 3 voices, and was last updated 3 years, 5 months ago by Coach Williams.
-
AuthorPosts
-
April 18, 2023 at 3:29 PM #193744
Pertanyaan ke 1
Ko William klu qt mau tanamkam backdoor pakai tools bantuan burpsuite biar tercapture responnya kan, biar bisa diganti nama dll dari web upload tersebut, terus klu misalnya webnya itu tidak perlihatkan nama dll sehingga gak bisa diganti otomatis udah gak bisa ya?Pertanyaan ke 2
qt mau lewati upload backdoor kan bisa lewat disusupi backdoor digambar yg qt mau uploadkan dengan bantuan burpsuite, terus disitu misalnya responnya ada cookie tulisannya lang, nah
Qt bisa Ditambahkan hasnya dari gambar yg qt upload kan, terus klu misalnya qt gak tau lokasi teruh file uploadnya otomatis gak bisa kan? Atau masih ada cara lain ko?? Kan harusnya qt tau lokasinya tempat file uploadnya dimana kan., biar bisa diambil hash dari gambar upload tersebut untuk digabungkan dengan cookie yg bertuliskan langnya..April 19, 2023 at 5:24 PM #193759jawaban pertanyaan 1 dan 2 :
saya agak sedikit bingung apa yg ditanyain karena terminologi yg dipakai ga cocok dan ngaco, saya asumsi mas menanyakan kalau kita mencoba mengupload file backdoor ke sebuah website yang mengganti nama filenya apakah kita masih bisa mengeksekusi backdoor nya tidak? iya tpi ada dua hal yg mesti diperhitungkan:
1. setelah di upload lokasi file dikasih tahu atau ngga?
2. setelah di upload ekstensi nya diubah atau tidak?kalau dua hal ini bisa dijawab berarti masih bisa
April 19, 2023 at 5:47 PM #193762Ohh ok makasih 🙏👌
April 24, 2023 at 4:41 PM #194288ok sip
April 24, 2023 at 5:50 PM #194303Iya coach soalnya saya sekarang lagi main-main di Hackerone (open bug bounty) jadi agak susah webnya buat cari celahnya, sapa tau ada saran dari coach Williams? 🙏
April 29, 2023 at 10:42 AM #195009April 29, 2023 at 10:42 AM #195010May 3, 2023 at 9:04 PM #195406Ok coach makasih, sejauh ini Teman-teman saya di komunitas hacking, klu di platfrom bug bounty,mereka lebih banyak dapat bug Idor sama XSS,,klu di web pemerintah mah pernah dicoba, hampir semua bug ada..
May 5, 2023 at 6:12 PM #195507sip good luck
May 20, 2023 at 11:54 PM #196126saya mendapatkan email seperti ini dan pengirimnya saya sendiri. apakah ini benar? tetapi saya tidak pernah membuka situs dewasa di lbtop ini. yang saya heran kenapa dia bisa mengirimkan melalui email saya sendiri dan itu berada di spam.
bagaimana cara mendeteksi malware yang sudah terlanjur terinstal dan kita tidak mengetahui dari mana asal malware tersebutHi,
I am a hacker, and I have successfully gained access to your operating system.
I also have full access to your account.When I hacked into your account, your password was: sensor
I’ve been watching you for a few months now.
The fact is that your computer has been infected with malware through an adult site that you visited.
If you are not familiar with this, I will explain.
Trojan Virus gives me full access and control over a computer or other device.
This means that I can see everything on your screen, turn on the camera and microphone, but you do not know about it.
I also have access to all your contacts and all your correspondence.Why did your antivirus not detect malware?
Answer: The malware I used is driver-based, I update its signatures every 4 hours. Hence your antivirus is unable to detect its presence.
I made a video showing how you satisfy yourself in the left half of the screen, and the right half shows the video you were watching at the time.With one mouse click, I can send this video to all your emails and contacts on your social networks.
I can also make public all your e-mail correspondence and chat history on the messengers that you use.If you don’t want this to happen, transfer $1490 in Bitcoin equivalent to my Bitcoin address (if you do not know how to do this, just search “buy bitcoin” on Google).
My Bitcoin address (BTC Wallet) is: 1LzGn637qgKdsw7UH6S2A17vEbwL8ytHXY
After confirming your payment, I will delete the video immediately, and that’s it. You will never hear from me again.
I will give you 50 hours (more than 2 days) to pay. I will get a notice, when you open this email, and the timer will start.
Filing a complaint somewhere does not make sense because this email cannot be tracked like my Bitcoin address.I never make any mistakes.
If I find that you have shared this message with someone else, the video will be immediately distributed.Best regards!
May 25, 2023 at 11:36 AM #196548oh itu hanya scareware saja ignore aja
-
AuthorPosts
- You must be logged in to reply to this topic.