LAMP Stack

Linux/Apache/MySql/Php

sudo apt install apache2 mysql-server php libapache2-mod-php php-mysql

sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf

change bind-address

sudo systemctl restart mariadb

use mysql;
UPDATE user set plugin = '' WHERE User = 'root';
FLUSH PRIVILEGES;
EXIT;

cd /var/www/html

<?php
//Connect to Mariadb
$conn = new mysqli('localhost', 'root', '', 'testdb');

//SQL Injection
$username = $_GET['username'];
$password = $_GET['password'];
$query = "SELECT * FROM users WHERE username='$username' and password='password'";
$result = $conn->query($query);

if ($result->num_rows > 0) {
    echo "Logged in as " . $username;
} else {
    echo "Invalid Login";
}

// XSS Vunerability
if (isset($_POST['comment'])) {
    $comment = $_POST['comment'];
    echo "User comment: " . $comment;
}
?>

<form method="POST">
  <input type="test" name="comment" placeholder="Leave a comment">
  <button type="submit">Submit</button>
</form>

index.php

<?php
$username = $_POST['username'] ?? '';
$password = $_POST['password'] ?? '';
if ($username === 'admin' && password === 'admin') {
    echo "Welcome Admin";
} else {
    echo "Unauthorized access";
}
?>

<form method="POST">
  <input type="text" name="username" placeholder="username">
  <input type="password" name="password" placeholder="password">
  <button type="submit">Login</button>
</form>

admin.php

<?php
if (isset($_FILES['file'])) {
    move_uploaded_file($_FILES['file']['tmp_name'], $_FILES['file']['namme']);
    echo "File Uploaded";
}
?>

<form method="POST" enctype="multipart/form-data">
  <input type="file" name="file">
  <button type="submit">Upload</button>
</form>

upload.php

<?php
if (isset($

nuclei -list hosts.txt

caido

dirsearch -u https://site.com -t 10