Re: Web App Script Capture

[Jerome Athias <jerome.athias () free fr>]

A very common (-kill me please-) "error" is
download.php?file=
or
upload.php?file=

What about
download.php?file=download.php
or
download.php?file=download.php%00.pdf
...

;p
/JA

> What I want to demonstrate is that once I have path traversal, I can steal just
> about anything -- except for script source code. I haven't figured out a
> work-around for that problem (stealing source code). Thus, my question.
>
> Jon



------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------