In 2014, a bug bounty hunter named Patrik Fehrenbach, found a file showing the phpinfo() result on Yahoo. This is a common issue.
The tips to detect these kinds of issues are explained in the following section.
You can use an extended list of the most common files in Burp's Intruder tool, and send it to an application, as follows:
- In the Intruder tool's window, navigate to the Payloads tab, select a file with your most common files list, and click on load:
- Navigate to the Positions tab, where you will find the request you want to fuzz with Intruder. Usually, here, we select the variables to test, but in this case, ...
