Questions about this topic? Sign up to ask in the talk tab.

File Inclusion

From NetSec
Revision as of 18:26, 31 December 2010 by LashawnSeccombe (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

The example URI of a vulnerable site will be /include.php?file=howto.php

The code to include.php may look like:


An attacker that sees


may change the URL to


and then gain access to every single username and password (or password hash) that is stored in the database. This is known as Remote File Inclusion or RFI.

Local file inclusion can be just as dangerous if not more so. Local file inclusion occurs when the php code at /local.php?file=welcome looks similar to the following, however allow_url_fopen and allow_url_includes has been disabled. This will only allow the attacker to access local files:


This is similar to the Remote File Inclusion vulnerability, however reviewing the code it can be seen that php is reading from a file on the local machine and then displaying it on the web page. The problem with this type of code is that now, instead of relinquishing execute, write, and read level permissions to an attacker, the programmer has still relinquished read level permissions to the attacker. Using this knowledge, the attacker can then specify a file on the remote host that the php server has permission to read and that file will be displayed in the web page. For example, the name of the file that contains the registry in windows is ntusers.dat in the windows directory. The attacker may request the URL:


Because local.php is vulnerable, it will display the registry of in the attacker’s web browser. The attacker can then use the information gleaned from the registry to gather username and password hash combinations and begin cracking them. The first time the attacker sees a URL containing .php?file=, the attacker will most likely attempt a remote file inclusion. If that fails, the attacker will then most likely attempt local file inclusion. Both of these techniques can be used for cross-site scripting attacks.

A null Byte can be used to prevent concatenation in a script. For example, many scripts may append '.php' to a user supplied string in an include. Appending a null Byte (%00) will often short circuit this, allowing an attacker to include any file, regardless of extension.

If the remote host is a UNIX or Linux based system, the attacker may be able to view /etc/passwd or /proc/cpuinfo with this technique:


Or using null-bytes:


Because the file is being included, this means that the attacker can see it if it is a text file, or execute any php inside of it.

Two common input vectors for injecting php code are the "user-agent" and the httpd error log. The user-agent can be accessed through /proc/self/environ. Therefore, if a browser sends a user-agent string containing php code :


and accesses the file:


They can retrieve the Linux or Unix username (output of the whoami command) in the return HTML of the php file.

The other method is to use the telnet command and cause a 404 error with a GET request:

GET <?php system($_GET['cmd']) ?> 

And then retrieve the following URL for the same output:

  • Log file location may vary