Is the etc/passwd file useful

[Sgt.Moody]

Well , I have been trying to hack a website but all what I got is the etc/passwd file . Is it useful ?
I heard that you can brute force the cpanel using it .

[ande]

The passwd file is informational but not really useful for getting into user accounts. Passwords are (no longer?) not stored in the passwd file but the shadow file. The shadow file contains a hashed version of the password which could be brute forced.

[Sgt.Moody]

Thank you Ande that's great .


another question :  if the website is vulnerable to LFI , can I read the shadow file ?

[ande]

Thank you Ande that's great .


another question :  if the website is vulnerable to LFI , can I read the shadow file ?

You will most likely not be able to read the shadow file. The only scenario this would be possible is if the web server is running as root or the shadow file permissions are messed up.

[Sgt.Moody]

You will most likely not be able to read the shadow file. The only scenario this would be possible is if the web server is running as root or the shadow file permissions are messed up.

Thank you this really helped