Using and Closing the php Inklud Vulnerability

. :( Next Generation Hackers Group) :. Ngh.void.ru
Article written by: vizor'om
----------------- | Date of writing: 30/03/05
----- | Contacts: gotius ([email protected]) and rel4nium ([email protected])
Use and closure of the vulnerability php includ.
The purpose of the article is to show you how to fix one of the varieties of php includa,
And how to use it.
This vulnerability has been known for a long time, but even today it still occurs ...
This vulnerability is that if a page is written in the site directory written in php,
And an unknown extension of the file, php will open the source text of the document, which means that we can
It's easy to find the admin password in its source (although the password can not always be opened).
For example, a site has a page opening structure of this kind:
Www.victim.com/index.php?aux_page=aux1
Duck here if we instead of aux1 substitute in aux_page = for example index.php then it will give us index.php,
(It happens that even without an unknown extension the script shows us the source code of the page) and
If we put instead index.php index.inc then the bass script will process this request and print
Us the page index. And after you see the source of the index page, you can find
The page on which passwords are written in clear!
eg:
Www.victim.com/index.php?aux_page=connect.inc
This should lead us to the passwords, but they can lie and not in connect.inc, so if you are good
You can learn the passwords easily.
This is all we can do with the help of a crooked script on php, it can be of this content:


Now the variable can be assigned only values ​​of the form aux [0; ..] (for example aux1, aux44)
After that it will be impossible to view the source of the document via php inklud.
Ps all the scripts listed in the article are fictitious, any correspondence with reality is not true :)