Hacker News Reader

HITCON CTF has a realistic php2shell challenge. Think it has ended up with 0 solves so far, not sure.

The "realistic setup" used for this didn't have a php page on it initially.

I'm skeptical of the value of such setups, unless it's clear it's an out of the box setup, and we already know those are totally broken.

I don't understand who these people think they are really fooling. Is this some AI denial?

you've been posting about "AI denial" all over this thread, feeling incompetent?

This isn't even a good attempt at trolling, do better.

There are many PoCs online that work on realistic setups (like PHP docker image). If you're curious you can try to replicate it locally.

there are a number of php docker images. some are insecure by default.

many php setups sit behind nginx, caddy, or other webserver with a max body size limit.

anyone following OWASP / similar guidelines was probably okay here (for this particular PoC path), if not using apache/mod_php, i would think.