Imagine if you will, we have a web server that allows file uploads, and many of
these do exist
across the entirety of the internet, and then imagine that we don't have any
method to verify
that the files being uploaded are actually what they're supposed to be or the
contents within them.
Well, that's the situation that we have set up inside of this particular skill,
as we're going to exploit file inclusion vulnerabilities inside of bWAP. Now,
you may be wondering what
file inclusion is, and I'm going to ask the example that we had of having a web
server that allows
file uploads, but doesn't have any form of verification or validation is a file
inclusion
vulnerability. Essentially, we're going to upload a file regardless of what it
may or may not be
independent regardless of its contents, and the web server is just going to say
, "Okie-dokie."
So, that in itself is not really that bad until you realize that part of the
vulnerability
includes permissions to be able to access that file. Now, we've seen, up to
this point, the ability
to be able to go through and do directory traversal and access some of the file
contents
through a file traversal, but here we are getting ready to execute those files
within the actual
file system of our host web server. Now, this is going to be dependent upon
whether
or the base operating system that's running the actual web server itself,
and less dependent upon the versioning of the web server. What this really
focuses in on is a
vulnerability that's highly known in the PHP world. What we're taking a look at
up top right up there
is the PHP file inclusion awasp description. Now, I'm going to put both of
these links in
right below this video so that way you at home can go read up on this a little
bit and get a
more detailed understanding of actually some of the code and also some of the
exploits and defenses
that Oh, lost recommends will be doing a couple of practical exercises as well
and reinforcing
skills from directory traversal and going through the file system for those
individual files to
kind of complete the whole chain of being able to exploit a file on a system.
Now,
what I really want to point out here is that right here, it does highlight PHP
and it also lets us
know that this does occur in other languages. This has been known to happen in
things like CSS,
but primarily in languages that invoke a sub sort of runtime environment within
the background.
Now, if you'll remember inside of our web server that we have PHP inside of its
own folder and we're
using PHP version seven point something something something something something
something something
something something something. Does this vulnerability go away with version
eight? Not necessarily,
while there may be some code that was patched by Microsoft and the PHP project.
It's all coming
down to permissions being the crux of the PHP file inclusion vulnerability
problem. And that's
where our test website be WAP and dot test within our lab environment is going
to hone in on in terms
of actual exploiting this vulnerability. As you go through, you can see where
there are different
examples related attacks and how specifically I'll get there sooner or later.
This works with
the post and get request. Now, that's key because we'll continue to be using
burp suite and in
intercept the actual packets for this particular site and also kind of verify
that we place the
file where it's supposed to go or we're able to see it at least right so so far
so good.
And you can see that there are technical control or controls and technical
impacts of what's
actually going on. Now, the second link that I'm going to have up here is how
to test for file
inclusion. Specifically, this covers how to test. Now, there's a lot of
different relatable material
in here. I just wanted to point out that this really hones in on the PHP
vulnerability side
because that's the focus of what's going on here. And if you see right here,
PHP 7.2,
you'll notice that these are older versions of PHP where this vulnerability
still exist,
always update your systems and verify those patch notes and security
requirements.
Now, there's a whole different tool set listing out there for remediation as
far as this is concerned.
But if you really want to go in and take a look at some of the tools, you'll
notice that we have
a usual suspect here of something we've already practiced on would be the OOS-Z
attack proxy
the ZAP proxy. That's right. That tool that we used as we stated before
incorporates OOS
information in terms of how it checks for those vulnerabilities. So
theoretically, if you want to
go back into the previous skills and test for yourself, you should be able to
see this PHP
vulnerability or something very similar pop up against BWAP.test. And if I
remember correctly,
it did in fact pop up. Now, also, you can see here that this right here is the
PHP code. We're
going to get into a little bit of understanding how to make a baddie file and
send it up and use
that file for manipulation and set the stage for things moving forward as far
as like sending a
netcat back channel for us to be able to remote shell and all this other great
stuff. But I want
you to remember that we are not getting too deep into the code inside of this
particular skill.
There are plenty of courses here on CBT nuggets that go deeper, way deeper into
the actual program
and programming logic that is PHP and many other languages. We're only here to
be able to
try to test and exploit potentially those vulnerabilities that we see on the
actual web servers. And it
also reinforces the fact that in the last skill we talked about that we don't
necessarily have to
know every single thing out there. We just have to know how to research really
well and have a base
understanding of a lot of the skills and knowledge within this course and then
not be afraid to reach
out for help and research at the exact same time.