23 ms·
I still lost. Can somebody give me an example of what an "improperly escaped include" would look like? Was the site author (not the hacker) taking a get param
by robotrout 17y ago
I still lost. Can somebody give me an example of what an "improperly escaped include" would look like?
Was the site author (not the hacker) taking a get parameter and passing it to an include? That seem odd.
I need a little more help understanding this.
- deleted 17y ago[deleted]
- DougBTX 17y agoProbably a directory of php files like, sections/food.php sections/shopping.php sections/fryclub.php with different content, then an index page like, <!-- common header --> <?php include("sections/" . $_GET["section"] . ".php") ?> <!-- common footer --> And then when you access, http://fry.com/index.php?section=fryclub you get the content of fryclub.php with the correct headers and footers. Or you access, http://fry.com/index.php?section=/../.[snip]./../etc/passwd%00 and get any file you like, treated like a php file. Find a file that you can write to (such as the error log), use the above trick to treat it as a php file, use it to make system calls, and the box is yours.
- robotrout 17y agoThanks for that. I wasn't aware that this was a common practice. I assumed it must be something like that, but I wanted to make very sure I understood exactly. Don't want any hacker news stories about my sites! EDIT: Errr, at least, not this sort of story.
- deleted 17y ago[deleted]
- DougBTX 17y agoYou can actually search for this vulnerability on Google Code Search, and it finds a few results that look exploitable. I don't know how to go about informing people with that code that their systems are vulnerable. Many are open source projects, so anyone using those tools are vulnerable too.
- bricestacey 17y agoIt's a pretty common attack. I have several identical attempts against my website on a daily basis (can easily tell from the access logs).
- deleted 17y ago[deleted]