search

copyFI (File Inclusion)

In some scenarios, web applications are written to request access to files on a given system, including images, static text, and so on via parameters. Parameters are query parameter strings attached to the URL that could be used to retrieve data or perform actions based on user input.

Table of contents:

hashtag
Path Traversal

Also known as Directory traversal, a web security vulnerability allows an attacker to read operating system resources, such as local files on the server running an application.

https://www.php.net/manual/en/function.file-get-contents.phparrow-up-right

Perform a path traversal:

http://webapp.thm/get.php?file=../../../../boot.ini

  • Notice the ../../../

hashtag
Interesting files for Linux:

/etc/issue
/etc/motd
/etc/group 
/etc/resolv.conf
/etc/shadow
/home/[USERNAME]/.bash_history or .profile
~/.bash_history or .profile
$USER/.bash_history or .profile
/root/.bash_history or .profile
/etc/mtab  
/etc/inetd.conf  
/var/log/dmessage
.htaccess
config.php
authorized_keys
id_rsa
id_rsa.keystore
id_rsa.pub
known_hosts
/etc/httpd/logs/acces_log 
/etc/httpd/logs/error_log 
/var/www/logs/access_log 
/var/www/logs/access.log 
/usr/local/apache/logs/access_ log 
/usr/local/apache/logs/access. log 
/var/log/apache/access_log 
/var/log/apache2/access_log 
/var/log/apache/access.log 
/var/log/apache2/access.log
/var/log/access_log
.bash_history
.mysql_history
.my.cnf
/proc/sched_debug
/proc/mounts
/proc/net/arp
/proc/net/route
/proc/net/tcp
/proc/net/udp
/proc/net/fib_trie
/proc/version
/proc/self/environ

hashtag
Interesting files for Windows:

hashtag
Local File Inclusion (LFI)

LFI attacks against web applications are often due to a developers' lack of security awareness. With PHP, using functions such as include, require, include_once, and require_once often contribute to vulnerable web applications. LFI exploits follow the same concepts as path traversal.

Scenario (1):

Suppose the web application provides two languages, and the user can select between the EN and AR:

The PHP code above uses a GET request via the URL parameter lang to include the file of the page.

Theoretically, we can access and display any readable file on the server from the code above if there isn't any input validation.

Using null bytes to bypass filter

Using null bytes is an injection technique where URL-encoded representation such as %00 or 0x00 in hex with user-supplied data to terminate strings. You could think of it as trying to trick the web app into disregarding whatever comes after the Null Byte.

By adding the Null Byte at the end of the payload, we tell the include function to ignore anything after the null byte which may look like:

NOTE: the %00 trick is fixed and not working with PHP 5.3.4 and above.

Bypass filter trough more slashes

Next, in the following scenarios, the developer starts to use input validation by filtering some keywords. Let's test out and check the error message!

f we check the warning message in the include(languages/etc/passwd) section, we know that the web application replaces the ../ with the empty string.

First, we can send the following payload to bypass it:

hashtag
$_REQUESTS

$_REQUEST is a super global variable which is widely used to collect data after submitting html forms. Now in contact. php we can collect the data entered by the user in different fields using $_RQUEST. You can try to send a POST request instead of a GET request in order to get FI!

Remote File Inclusion - RFI

Remote File Inclusion (RFI) is a technique to include remote files and into a vulnerable application. Like LFI, the RFI occurs when improperly sanitizing user input, allowing an attacker to inject an external URL into include function. One requirement for RFI is that the allow_url_fopen option needs to be on.

The risk of RFI is higher than LFI since RFI vulnerabilities allow an attacker to gain Remote Command Execution (RCE) on the server. Other consequences of a successful RFI attack include:

  • Sensitive Information Disclosure

  • Cross-site Scripting (XSS)

  • Denial of Service (DoS)

hashtag
LFI to RCE using apache log poisoning

Remedation

As a developer, it's important to be aware of web application vulnerabilities, how to find them, and prevention methods. To prevent the file inclusion vulnerabilities, some common suggestions include:

  1. Keep system and services, including web application frameworks, updated with the latest version.

  2. Turn off PHP errors to avoid leaking the path of the application and other potentially revealing information.

  3. A Web Application Firewall (WAF) is a good option to help mitigate web application attacks.

  4. Disable some PHP features that cause file inclusion vulnerabilities if your web app doesn't need them, such as allow_url_fopen on and allow_url_include.

  5. Carefully analyze the web application and allow only protocols and PHP wrappers that are in need.

  6. Never trust user input, and make sure to implement proper input validation against file inclusion.

  7. Implement whitelisting for file names and locations as well as blacklisting.

PreviousXXENextFile upload

Last updated