File inclusion attacks now in Web applications, developers sometimes can include files stored on local
or remote servers.
Referencing files other than the ones in the webroot may cause a full system compromise if the server
software executes the included file.
So this action we are going to discover.
Some file inclusion vulnerabilities.
There are basically two types of fire inclusions, local or remote file inclusion.
The local voyle inclusion comes out when the user accesses a local file out of the Web root directory.
And the access file is included in the execution environment of the Web application.
And won't file inclusion comes out when the user includes a remote file into the execution environment
of the Web application, so that way the included file is going to be executed with the actual content
and served up to the user.
Now, besides being an authorisation problem, some people can categorize past traversal and file inclusion
vulnerabilities as input validation problems.
No matter how you categorize it, it is up to us to evaluate how these vulnerabilities work.
So go to Caleigh and I'm going to show a basic file inclusion, so log in to be Web and from the menu
above, go to remote and local file inclusion.
Now, you see there's a drop down menu of languages, so when you choose a language and go, then the
you are Eliz change to this.
And then a language parameter is added with the value of the chosen language.
But this value seems to me to be a page laying underscore in that BHP.
Yeah.
So this is suspicious.
So the application know the language file when a user chooses that language, you see.
So for us to benefit from this.
Hmm.
Maybe we're able to load another file on the system.
What do you think.
Well, let's go and enable Foxe proxy.
And click on Go.
OK, so now go to berp and the request comes to berp, but before forwarding from the action button,
let's send the request to the repeater tool and then the request go now open up the repeater tab.
All right, so here's a request, so send it to the server.
And it executes without any problem, so let's try to read the magic file on Linux.
So instead of this profile type slash EDC slash password.
And send the request.
OK, so now let's look at the response, here's a result.
We can read a file out of the Web directory now, change the cookie security level to medium.
OK, he said this to one.
And this same request.
So it doesn't work this time, but look at the year.
Because it depends upon extension to the end of the file we provided.
So we need to get rid of this extension to read the file content, and we do have a little trick for
that.
You want to know?
All right.
So just add a nail biter to the end of the file.
Present seven zero.
And the request.
And scroll down, see the response and the content of the file is here.
All right, so now clear here and go back to low level.
I want to show you another payload so sometimes be rappers can help us read a file on a system.
So he comes with many built in raptors for various world style protocols for use with filesystem functions.
So what I'll do is I'll just add a filter here.
HP Crowlands last filter slash resource equals slash etek slash password.
And.
The response has the file content.
Yeah, so when you want to read a special file types such as AP or XML, it will break the execution.
So in these types of situations, you can encode the file if you want to view it.
So now I'm going to paste this payload here.
And it'll convert the file to base64, send the request.
And what you see here is a response has the basic C4 output of the foil, so I'm going to copy just
that part.
And open to Khoder and paste it here.
And then decode is base64.
OK, here is the content of the password file.
Now, you may wonder what's the difference between the past traversal and the local fire conclusion?
Yeah, many people on the surface might confuse the two, but I'll tell you that in a past traversal
flaw, the application will only read the contents of the file or directory and then display it.
But in a file inclusion flaw, instead of displaying the content, the application will include the
file as if it is an executable script and then execute it with the same privileges as the Web application.
So I think that's a pretty big difference.
And it's, you know, the most evident difference between the two.
But they're both very useful.
OK, so let's exploit them then and this way.