Apache vulnerability suffix resolution Vulnerability

We all know that in Windows + iis6.0, if there is a directory like XXX. asp in the directory structure, all files under this directory will be parsed as ASP regardless of the extension. We generally call this vulnerability Windows2003 + iis6.0 directory Parsing Vulnerability. However, what you may not know is that the Apache server has similar parsing vulnerabilities.
Let's start the experiment. I have built a local Apache + PhP testing platform.

Two files: phpinfo. php phpinfo. php. A. Visit phpinfo. php..
Http: // 192.168.99.110/phpinfo. php.
 

It can be parsed and can still be changed to another suffix.
No matter what the last Suffix of the file is, as long as it is. PHP. * The end is parsed into a PHP file by the Apache server. The problem is that if Apache is in mime. the types file does not have a defined extension such as x1.x2. in the case of X3, the last X3 is not defined, and it will be parsed into the second-to-last X2 defined extension. Xxx.php.rar or XXX. php.111 will be parsed to PhP if they are not defined in the mime. types file by default. The same is true for CGI or JSP...
If the WebProgramOn the upload page, if the name of the uploaded file is defined by us, we can completely upload a webshell named xxx.php.jpg. Apache will still be parsed as PHP, And we will test JPG again.

Defense method:
The Apache configuration file prohibits execution of files such as. php.
<Files ~ "/. (PHP. | php3.)">
Order allow, deny
Deny from all
</Files>

Save. After Apache is started, let's take a look.

OK. This is the defense method.