Linux filename xss

1. File Name
We all know that in windows, there are rules for file names and some reserved characters are defined. They are:

< (less than)> (greater than): (colon)" (double quote)/ (forward slash) (backslash)| (vertical bar or pipe)? (question mark)* (asterisk)

In linux, most of these characters are not restricted and can be defined at will. Therefore, we can store XSS Pyload in the file name ,:

We can see that xss pyload is successfully stored in the file name.
Ii. Attack
Most of the time, the various code environments make it possible for us to launch attacks. Check the following PHP file upload code:

<?phpif ($_FILES["file"]["error"] > 0)  {  echo "Error: " . $_FILES["file"]["error"] . "<br />";  }else  {  echo "Upload: " . $_FILES["file"]["name"] . "<br />";  echo "Type: " . $_FILES["file"]["type"] . "<br />";  echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";  echo "Stored in: " . $_FILES["file"]["tmp_name"];  }?> 
When the file is uploaded successfully, the program outputs the file information. At this time, the file name is not processed. If we upload the file name of the defined special character and output it through the program, we can attack it ,:

We can see that the attack was successful! Not all upload locations exist. Only the following conditions must be met:
1. An original output is made before the file is uploaded and saved.
2. Store them directly by the original file name.
3. Check the program logic for other specific environments.
4. web server is linux.
5. Upload the attacker to linux.
Sample Code: http://code.google.com/p/madal-example-project/source/browse/trunk/controllers/image_uploader.php? R = 2
For more information, see http://code.google.com/query/?q===_files=%22file=22???=22name=22].
Online attack test: http://www.woyigui.cn/fileupload.php
Iii. Prevention
1. Save as a random file name during storage.
2. After processing the file name at any time, the file name can be output after html encoding.
Iv. Statement
The idea of this article comes from the idea of drinking miao at night. I just want to summarize and verify it.
Refer:
Http://msdn.microsoft.com/en-us/library/aa365247%28VS.85%29.aspx
Reprinted Please note: woyiguis blog