Repository navigation
Week 2 Lab 2.2
To start the website I copied the code from the assignment page
<html>
<body>
<!--StartFragment-->
<a href="index.php?page=page1.html"><button>page1</button></a><br/><a href="index.php?page=page2.html"><button>page2</button></a><br/><a href="index.php?page=page3.html"><button>page3</button></a><br/><?php$page = $_GET['page'];echo "<div>";if(isset($page)){ include("$page");}else{ echo "<p>select a page</p>";}echo "</div>";?>
--
<!--EndFragment-->
</body>
</html>
And I used this simple code for the HTML pages:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>J's Test Site</title>
</head>
<body>
<h1>Welcome to J's Test Site</h1>
</body>
</html>
The text on each page was changed slightly each time.
For context, this output can happen for many reasons such as: Lack of input validation, improper file handling, a directory traversal vulnerability, or just a misconfigured web server to name a few reasons.
To get it to show this output all I had to do was use the same method as last time with "os-release" at the end of the URL. This happens because of the same reasons listed above.
PHP's built-in web server is a powerful tool for local development and testing. It allows developers to run PHP scripts without the need for a full-fledged web server like Apache or Nginx. This article outlines how to set up a PHP server, create a simple local file inclusion (LFI) environment, and understand its implications.
Setting Up the PHP Server
Create a Directory:
Navigate to your working directory. For example:
mkdir ~/SEC480/week2/file-inclusion cd ~/SEC480/week2/file-inclusion Create index.php:
This file will serve as the main entry point for the application. Create index.php with the following content:
"; if(isset($page)) { include("$page"); } else { echo "select a page
"; } echo ""; ?>Create HTML Pages:
Create three HTML files: page1.html, page2.html, and page3.html, each containing arbitrary content. Example for page1.html:
html
<h1>Page 1</h1>
<p>This is the content of Page 1.</p>
Run the PHP Server:
In your terminal, navigate to your file-inclusion directory and run the following command: bash
php -S localhost:8000
Accessing the Server:
Open a web browser and navigate to http://localhost:8000/index.php. Click the buttons to include different pages.
Understanding Local File Inclusion (LFI)
This setup demonstrates a basic Local File Inclusion vulnerability. When user input is directly included in the include() statement without proper validation, it allows for the inclusion of arbitrary files, which can lead to security risks.
Example of Exploiting LFI
To test the vulnerability, you can try to include sensitive system files (like /etc/passwd) by modifying the URL:
http://localhost:8000/index.php?page=../../etc/passwd
This will attempt to display the contents of the passwd file if the server is configured to allow such operations.
Conclusion
The PHP built-in server provides a convenient way to test and develop PHP applications locally. However, it is crucial to be aware of security vulnerabilities, such as Local File Inclusion. By following the steps outlined in this article, you can effectively set up a local testing environment while understanding the importance of securing user inputs.