The third type of vulnerability that we looked at was the file inclusion and we looked at two types,
the local file inclusion, which allowed us to include any file on the system and then read files which
will cause a file disclosure vulnerability, and then you'd be able to read any file on the server.
And then we looked at the remote file inclusion, which is very dangerous, which allowed us to include
any file from any Web server.
So we were able to include BHP shells and then get Conexion from the target computer.
To prevent this, first of all, make sure you prevent the remote fall inclusion, so just in case anything
goes wrong, people can't include files from outside your server and you can do that the same way we
enabled it using the API by disabling the allow yourself open and allow your URL include.
And if we go here to our little exploitable, I'll just show you very quick.
So if we do.
Pseudo Nano, which is the text editor at CGI with a tiny the same file that we used.
This is the file for the HP settings if you open that file.
And now I'm going to do controlled W.
And look for.
Allow your el.
And you want to make sure that they allow yourself openly said to of.
And the L include is said to off as well.
Control X, Y and enter, and that'll save it for you.
The other way to prevent these exploits is to use static file inclusion, so instead of using dynamic
file inclusion, which we've seen, you can hard code the files that you want to include in the code
and not get them using get or post, for example, what's happening.
And the examples we see in the vulnerable examples is we have a page called Page or Indexed that BHP.
And then this index that takes a parameter called Page, and then it takes another page, for example,
news that BHP and it includes this newspaper in the code.
So what's the code look like in the code?
You'll see something like.
Include.
So what this will do, basically, and that looks like this, I believe what this do it includes.
Whatever comes after the page parameter.
So the code will dynamically takes whatever that comes in after the page parameter and includes it in
the current page.
So this will be in the index, that BHP page.
OK, this is very bad because even if it's not get sometimes people use post and in post you won't see
this.
So it will be posted, but you can use a proxy such as proxy and this would look like that and then
you can modify it and get it to include anything you want and then it's displayed on the page.
What we really want to do is we want the user not to be able to manipulate with what's going to be included.
So if you want it to include a page called News that we just included inside this without giving the
user the ability to change it, I know you're going to program your code to just have it looking like
this.
But the users we know, we see how users can play with this and just get it to include anything they
want.
So the best way to do it is just to get it to include a page that BHB.
So your code is not using any variables.
It's it's hard coded.
It might make your code log longer, but it's much more secure.
And this is exactly what the high security option does.
So let's go back to the final conclusion first, and we're at the low.
And if I view the source now, you'll see that basically a file is what you pass through it.
So file is what we pass through it in here and the after the page parameter and you can see that it
tries to display anything that we send it.
So when we send it ATC password, it shows us the password.
Now I'm actually going to keep this open and I'm going to go to the security level, to the security,
and I'm going to set it to high.
And now the medium is similar to Zillow, so you can actually use the same, you can exploit it the
same way that we exploited the low.
So we're going to the house right away and we're going to view the source.
And I'm just going to minimize this because they have the two sources now so we can compare them.
So as you can see here in the low and medium security level, you can see that anything we pass to the
file of a variable, it will be displayed to us.
Whereas in here at the high security level, you can see that it is hard coded, that it is only allowed
to show us the include the BHP file.
So you can you can modify this if statement.
If you had a number of files that you wish to include, then you can allow them in here or you can have
them in a list.
But basically the concept is you only allow the files that the user is allowed to see.
So you can just have them in a list here.
You can use an our statement or you can just have a list and say if the file is in this list, then
displayed, otherwise give an error, saying the file is not found.
So avoid this.
Go with the hardcoded method.
Yes.
It doesn't look as pretty as this, but it's much more secure.