File Inclusion
- Remote FI vs Local FI vs directory traversary
What is the risk of File inclusion?
By default, an attacker can leverage file inclusion vulnerabilities to leak data, such as code, credentials or other important files related to the web application or operating system. Moreover, if the attacker can write files to the server by any other means, file inclusion might be used in tandem to gain remote command execution (RCE).
Path Traversal: web security vulnerability allows an attacker to read OS resources.
dot-dot-slash attack, take advantage of moving the directory one step up using the double dots ../. If the attacker finds the entry point, which in this case get.php?file=, then the attacker may send something as follows, http://webapp.thm/get.php?file=../../../../etc/passwd
Local File Inclusion (LFI)
- http://webapp.thm/get.php?file=/etc/passwd
- http://webapp.thm/index.php?lang=../../../../etc/passwd
- Using null bytes is an injection technique where URL-encoded representation such as %00 or 0x00 in hex with user-supplied data to terminate strings. You could think of it as trying to trick the web app into disregarding whatever comes after the Null Byte.
By adding the Null Byte at the end of the payload, we tell the include function to ignore anything after the null byte which may look like:
Get cloudneuf’s stories in your inbox
Join Medium for free to get updates from this writer.
include(“languages/../../../../../etc/passwd%00”).”.php”); which equivalent to → include(“languages/../../../../../etc/passwd”);
4. To make it clearer, if we try this concept in the file system using cd .., it will get you back one step; however, if you do cd ., It stays in the current directory. Similarly, if we try /etc/passwd/.., it results to be /etc/ and that’s because we moved one to the root. Now if we try /etc/passwd/., the result will be /etc/passwd since dot refers to the current directory.
5. Why did this work?
This works because the PHP filter only matches and replaces the first subset string ../ it finds and doesn’t do another pass, leaving what is pictured below.
Remote File Inclusion — RFI
