About safe Dog File upload bypass

Author: Tilt Rotation
[Email protected]
This article is an original article by the members of the Cora Lab

Part 1 Analysis

This article mainly studies the security dog's packet analysis function, because many people thought that the safe dog is through the regular to match, then say so for the moment. This application layer WAF does make a big head in the test. So how does a safe dog analyze our data?
Here I made a topology diagram:

Part 2 Testing process

• Test system: WINXP
• Scripting language: PHP5.4.45
• Web server: apache/2.4.23 (WIN32)
• Security Dog Version: 3.5.12048

Currently, upload test is done with a php file upload script.

<?PHPif((($_files["File"] ["type"] = = "Image/gif")|| ($_files["File"] ["type"] = = "Image/jpeg")|| ($_files["File"] ["type"] = = "Image/pjpeg"))&& ($_files["File"] ["Size"] < 20000))  {  if($_files["File"] ["error"] > 0)    {    Echo"Error:".$_files["File"] ["Error"]. "<br/>"; }  Else    {    Echo"Upload:".$_files["File"] ["Name"]. "<br/>"; Echo"Type:".$_files["File"] ["Type"]. "<br/>"; Echo"Size:". ($_files["File"] ["Size"]/1024). "Kb<br/>"; Echo"Stored in:".$_files["File"] ["Tmp_name"]; }  }Else  {  Echo"Invalid file"; }?>

Article reprint: http://blog.cora-lab.org/193.html

About safe Dog File upload bypass