Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just read a paper about Local File Inclusion on, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP code. Since it's not a correct HTTP request it gets logged in the apache error.log. Now the attacker can execute the PHP code within the error.log by doing something like Now what I don't understand is thefollowing: logs by default are not world readable, so www-data who owns the apache2 process is not able to read error.log and so cannot execute the code within it! How can a log poisoning attack be successful then??

share|improve this question
Obviously, logs have to be www-data-readable. – Mischa Arefiev Jan 27 '12 at 8:45
up vote 3 down vote accepted

Perfectly legal and smart attack.

You're question really boils down to "how does this work when logs are by default not readable by the webserver?".

The fact is that many webservers are set up with custom log directories where the access control is not necessary enforced. This happesn more often than you would think. In some cases the access control for the log files is wide open because sysadmin needed some other system to read them, and he just opened it up for all processes.

This can also be used to execute code from other log files like from the SSH auth log. More on this here:

Basically it boils down to wrong permissions on the files. Even so its a good attack which is very relevant.

share|improve this answer
This attack is demonstrated by me on Youtube: – Chris Dale Mar 17 '14 at 11:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.