The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

311

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 311

---

312

Chapter 9 

■

Injecting Code

Finding File Inclusion Vulnerabilities

File inclusion vulnerabilities may arise in relation to any item of user-supplied

data. They are particularly common in request parameters that specify a lan-

guage or location, and also often arise when the name of a server-side file is

passed explicitly as a parameter.

HACK STEPS

To test for remote file inclusion flaws, perform the following steps:

■

Submit in each targeted parameter a URL for a resource on a web server

that you control, and determine whether any requests are received from