How else can I upload a shell since the angry WAF will spit out anything or any variation of .pHp extension?

Comments Off on How else can I upload a shell since the angry WAF will spit out anything or any variation of .pHp extension?

Pentester-in-training here,

I’m testing an upload feature on a page, here’s the server header:

X-Powered-By: PHP/5.4

Access-Control-Allow-Origin: *

Server: Apache

Also I find it curious that the header does not show any WAF… anyway I tried to disguise the php shell using magic bytes, MIME deception, fuZziNg, double extension, CaSe VaRIaTioN and nothing, if it has php in it, the WAF will puke it out.

So what other techniques I missed or I don’t know to defeat this WAF?

submitted by /u/Sascha_Wohler
[link] [comments]

Read More >>

INterlogix Truvision NVR password reset

Comments Off on INterlogix Truvision NVR password reset

Since Interlogix abandoned us and we cannot email in to get a password reset Does anyone know a way or hack to this Have had old customers move and not give the new owners the info the alarm can be changed but not the NVR Any help would be great …

Read More >>