Server Parsing of the Upload Vulnerability Assistant

The upload vulnerability is a favorite and most popular attack method for website intruders. As a result, programmers are also racking their brains to filter the extensions of uploaded files from the previous blacklist, determine whether the extension is. asp ,. asa ,. cer and so on. Now, the White List can directly determine whether the extension is jpg, gif, png, rar, zip, and so on. Even the commonly used 00 cut-off upload does not work in many cases, however, this does not mean that the upload vulnerability is useless. When you see the directory parsing and file parsing problems on the server, the upload is also a return.

 
Windows2003 + IIS6.0 directory Parsing Vulnerability
 
1. All files under the xxx. asp Directory are parsed using asp.
2 1.asp;_2.gif files will also be parsed as asp files
 
Apache2.2.14 directory Parsing Vulnerability
 
No matter what the last Suffix of the file is, as long as it is. php. * The end is parsed into a PHP file by the Apache server. The problem is that if apache is in mime. the types file does not have a defined extension such as x1.x2. in the case of x3, the last x3 is not defined, and it will be parsed into the second-to-last x2 defined extension. Xxx.php.rar or xxx. php.111 will be parsed to php if they are not defined in the mime. types file by default. The same is true for cgi or jsp... If the upload page of the web program is involved, if the uploaded file name can be defined, then we can upload a xxx file. php. apache will still parse the webshell named abc as php.
 
Defense method:
The apache configuration file prohibits execution of files such as. php.
<Files ~ "\. (Php. | php3.)">
Order Allow, Deny
Deny from all
</Files>
 
Nginx-0.8.37 File Parsing Vulnerability
 
Accessing the http://www.bkjia.com/phpinfo.txt/abc.php will use the PHP file to export phpinfo.txt
 
Solution:
1. Modify php. ini, set cgi. fix_pathinfo to 0, and restart php reverse proxy service.
 
2. Add the following content to the nginx VM:
 
If ($ fastcgi_script_name ~ \ .. * \/. * Php ){
Return 403;
}

From http://www.imiyoo.com/blog? P = 42