the-web-application-hackers-handbook

652 Chapter 17 n Attacking Application Architecture
Figure 17-2: An attack that undercuts the database tier to retrieve arbitrary data
TIP If an attacker has file-write access, he can try to write to the application’s
configuration, or write to a hosted virtual directory to get command
execution. See the nslookup example in Chapter 10.
Using Local File Inclusion to Execute Commands
Most languages contain a function that allows a local file to be included within
the current script. The ability for an attacker to specify any file on the filesystem
is undeniably a high-risk issue. Such a file could be the /etc/passwd file or a
configuration file containing a password. In these cases the risk of information
disclosure is obvious, but the attacker cannot necessarily escalate the attack to
further compromise the system (unlike with remote file inclusion, as described
in Chapter 10). However, it may still be possible for an attacker to execute commands
by including a file whose contents he partially controls, as a result of
other application or platform features.
Consider an application that takes user input within the country parameter
in the following URL:
http://eis/mdsecportal/prefs/preference_2?country=en-gb