The of up vulnerability that we looked at was the final inclusion and we looked at two types the local
file inclusion with allowed us to include any file on the system and then read files which will cause
a file disclosure vulnerability.
And then you'd be able to read any file on the server.
And then we looked at the remote file inclusion which is very dangerous which allowed us to include
any file from any web server.
So we were able to include BHB shelves and then get connection from the target's computer to prevent
these.
First of all make sure you prevent the remote file intrusion.
So just in case anything goes wrong people can include files from outside your server and you can do
that the same way we enabled it using the BHB only by disabling the Allow yourself open and allow your
I'll include.
And if we go here to our display table I'll just show you very quick.
So we do pseudo Nano which is the text editor it is page PTG IPH reader.
I need the same file that we use.
This is the file for the HP settings.
If you open that file and I'm going to do control w I'll look for your el
and you make sure that the Allow yourself open said set off and allow your include a set to off as well.
Control X Y and enter and that'll save it for you.
The other way to prevent these exploits is to use static file inclusion.
So instead of using dynamic file inclusion which we see and you can hard code the files that you want
to include in the code and not get them using GET or POST.
For example what's happening and the examples we see in the vulnerable examples is we have a page called
Page or index that BHP and then this index does which takes a parameter called page and then it takes
another page for example news that Ph.D. and it includes this news BHB in the code.
So what's the code look like in the APHC code you'll see something like.
Include
So what this will do.
Basically that looks like this I believe what this do.
It includes whatever comes after the page parameter.
So the code will dynamically takes whatever that comes in after the page parameter and includes it in
the current page.
So this will be in the index page.
Ok this is very bad because even if it's not get sometimes people use post and in post you won't see
this so it will be posted.
But you can use a proxy such as barer proxy and this would look like that.
And then you can modify it and get it to include anything you want.
And then it's displayed on the page where you really want to do is we want to use or not to be able
to manipulate with what's going to be included.
So if you wanted to include a page called news that BHB just included inside this without giving the
user the ability to change it I know you're going to program your code to just have it looking like
this.
But the users we know we see how users can play with this and just get them to include anything they
want.
So the best way to do it is just to get it to include page that page.
So your code is not using any variables.
It's it's hard coded.
It might make your code LOEG longer but it's much more secure.
And this is exactly what the high security option does.
So let's go back to the file intrusion first.
And we're at the low and if I view the source now you'll see that basically file is what you passed
the word file is what we pass through it in here in the after the page parameter.
And you can see that it tries to display everything that we send it.
So when we send that ATC password it shows us the ATC password.
Now I'm actually going to keep this open and I'm going to go through the security level through the
security and I'm going to set it to high.
Now the medium is similar to the low so you can actually use the same you can exploit it the same way
that we exploited the load.
So we're going to the high straightaway and we're going to view the source and I'm just going to minimize
this because they have the two sources not so we can compare them.
So as you can see here in the low and medium security level you can see that anything we pass through
the file very variable is will be displayed to us whereas in here at the high security level you can
see that it is hard coded that it is only allowed to show us the include file so you can you can modify
this if statement.
If you had a number of files that you wish to include then you can allow them in here or you can have
them in a list.
But basically the concept is you only allow the files that the user is allowed to see.
So you can just have them in a list here you can use an OR statement or you can just have a list and
say if the file is in this list then displayed otherwise give an error saying the file is not found.
So avoid this go with the hard coded method.
Yes it doesn't look as pretty as this but it's much more secure.