From LOW to PWNED [8] Honorable Mention: Log File Injection

So this didn't make it into the talk, but was in the hidden slides...

not positive this is a "low" but a friend suggested it, so here you go.

Goes like this:

Request gets logged

Something malicious gets written commonly something like a one line PHP backdoor

1.  Use an LFI vulnerability to browse to page get shell

<a href="http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/">http://websec.wordpress.com/2010/02/22/exploiting-php-file-inclusion-overview/</a>

2. Wait for an admin to view logs and do whatever you did (XSS)

Can also do fun stuff like this (TNS Logfile injection in Oracle)