Advanced LFI - Part 9 Executing PHP through Apache's access.log

This time we execute our PHP code through creating a GET Request to our page that is the php file. This will of course fail because the php code isn't the name of a page.. So what this does is create a message in the Apache access log file. Now we run the Apache log file by requesting it through directory traversal and our php code is then executed. Please Note that this is an old well known method, which means it will NOT work on newer operating systems as the access.log file will not have sufficient privilege to execute the code. This is useful to know as a Proof Of Concept exercise when running pen tests on older machines or newer machines that are poorly configured..