the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 381
if it is the filesystem root, and any redundant traversal sequences that attempt
to step up above it are ignored. Chrooted filesystems are supported natively
on most UNIX-based platforms. A similar effect can be achieved on Windows
platforms (in relation to traversal vulnerabilities, at least) by mounting the
relevant start directory as a new logical drive and using the associated drive
letter to access its contents.
The application should integrate its defenses against path traversal attacks
with its logging and alerting mechanisms. Whenever a request is received that
contains path traversal sequences, this indicates likely malicious intent on the
user’s part. The application should log the request as an attempted security
breach, terminate the user’s session, and, if applicable, suspend the user’s account
and generate an alert to an administrator.
File Inclusion Vulnerabilities
Many scripting languages support the use of include files. This facility enables
developers to place reusable code components into separate files and to include
these within function-specific code files as and when they are needed. The code
within the included file is interpreted just as if it had been inserted at the location
of the include directive.
Remote File Inclusion
The PHP language is particularly susceptible to file inclusion vulnerabilities
because its include functions can accept a remote file path. This has been the
basis of numerous vulnerabilities in PHP applications.
Consider an application that delivers different content to people in different
locations. When users choose their location, this is communicated to the server
via a request parameter, as follows:
https://wahh-app.com/main.php?Country=US
The application processes the Country parameter as follows:
$country = $_GET[‘Country’];
include( $country . ‘.php’ );
This causes the execution environment to load the file US.php that is located
on the web server filesystem. The contents of this file are effectively copied into
the main.php file and executed.