In this section, we will look at how we can use SQLi to read any file in the server. So, even if the file exists outside the /www directory, we'll be able to read it exactly as with a file-disclosure vulnerability, and we'll see how we can use it to write files and upload them to the system, just as with a file-upload vulnerability.
First, let's take a look at reading the file; we are going to set everything to null. So, our statement is going to be as follows:
union select null,load_file('/etc/passwd'),null,null,null
Instead of selecting a column or a table, we want to run a function called load_file(), and we are going to set the file that we want to load. We're going to use the same file that we had a look at in the file-inclusion vulnerability, which was /etc/passwd. The URL command is as follows:
index...
