{"action":"opened","issue":{"url":"https://api.github.com/repos/mubix/cfdb/issues/14","labels_url":"https://api.github.com/repos/mubix/cfdb/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/mubix/cfdb/issues/14/comments","events_url":"https://api.github.com/repos/mubix/cfdb/issues/14/events","html_url":"https://github.com/mubix/cfdb/issues/14","id":121974350,"number":14,"title":"Local File Inclusion","user":{"login":"rmikehodges","id":10209556,"avatar_url":"https://avatars.githubusercontent.com/u/10209556?v=3","gravatar_id":"","url":"https://api.github.com/users/rmikehodges","html_url":"https://github.com/rmikehodges","followers_url":"https://api.github.com/users/rmikehodges/followers","following_url":"https://api.github.com/users/rmikehodges/following{/other_user}","gists_url":"https://api.github.com/users/rmikehodges/gists{/gist_id}","starred_url":"https://api.github.com/users/rmikehodges/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmikehodges/subscriptions","organizations_url":"https://api.github.com/users/rmikehodges/orgs","repos_url":"https://api.github.com/users/rmikehodges/repos","events_url":"https://api.github.com/users/rmikehodges/events{/privacy}","received_events_url":"https://api.github.com/users/rmikehodges/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-14T04:50:25Z","updated_at":"2015-12-14T04:50:25Z","closed_at":null,"body":"/*\r\nTitle: Local File Inclusion\r\nDescription: Search engine meta data about the finding\r\n*/\r\n\r\n- LAST UPDATED DATE: 12 - 13 - 15\r\n- LAST UPDATED BY: Mike Hodges\r\n\r\n## Summary\r\n\r\nLocal File Inclusion (LFI) allows the attacker the include files that are already locally present on the server\r\nthrough the exploitation of a flawed file inclusion procedure.\r\n\r\n## Capabilities and Risk\r\n\r\n- Could allow attackers to access arbritrary files on the system leading to\r\n  potential information information disclosure\r\n  \r\n- In more serious cases, LFI, can lead to remote code execution on the server and\r\n  complete compromise of the system. (https://www.exploit-db.com/papers/12886/)\r\n\r\n## Detection\r\n\r\n- Identify scripts that take filenames as parameters\r\n\t\r\n- Use directory traversal sequences in the filename parameter in order to access\r\n  a file that is known to be present on the system\r\n \r\n- If not immediately successful, attempt to identify the filter being used\r\n  and craft input that attempts to bypass it\r\n\r\n## Remediation\r\n\r\nImplement file inclusion procedures that properly sanitize all input.\r\n\r\n## References\r\n\r\n- https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion\r\n- http://hakipedia.com/index.php/Local_File_Inclusion\r\n- https://www.exploit-db.com/papers/12886/\r\n\r\n## Exploitation\r\n\r\nConsider the code below (Credit: OWASP.org)\r\n\r\n<?php “include/”.include($_GET['filename'].“.php”); ?>\r\n\r\nThe code is normally used like this:\r\n\r\nhttp://vulnerable_host/preview.php?file=myFile\r\n\r\nHowever an attacker can exploit the lack of sanitization by using null-byte terminators, %00, to effectively end the string before .php is added: \r\n\r\nhttp://vulnerable_host/preview.php?file=../../../../etc/passwd%00\r\n\r\nThis would results like the following:\r\n\r\nroot:x:0:0:root:/root:/bin/bash\r\nbin:x:1:1:bin:/bin:/sbin/nologin\r\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\r\nalex:x:500:500:alex:/home/alex:/bin/bash\r\nmargo:x:501:501::/home/margo:/bin/bash\r\n"}}