Learning Objective 4
Last updated
Was this helpful?
Last updated
Was this helpful?
Task
In the Attack Lab:
Find and exploit the LFI vulnerability in resources app https://resourcespharmacorp.azurewebsites.net/
Extract the information from the Application settings
Applies to: Attack Lab
Topics Covered: LFI Vulnerability Exploitation and Information Extraction
On the previous task we have found some endpoints, after investigating we have a ASPx webapp on the URL:
Scroll down and click on : Download Brochure
A new window opens and if we check the URL and the end, it is possible to read files.
Since is an ASPx app let's try to read the file:
After reading ther file we have found a ClientSecret.
After enumerating one resource we found the LFI vulnerability and it was possible to read the ASPx file WEB-INFO/web.xml and read a ClientSecret.
