Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I look for answer, is it possible to perform null byte injection on PHP code, and how vulnerable code should look like. Give me some example, as I noticed that:

<?php

echo $_GET['get'];

will not make code vulnerable. I want to know, what is possible hole in code, that can cause this kind of vulnerability, if possible. Any example would be appreciated and usefull. Thanks.

share|improve this question
    
    
hey thanks for your example. but i am still confused, as in used example on that page, i was able to load file /root/Desktop/demo-password.fl but when i putt %00 on the end of url i get error. what is point of using null byte if i was able to access files without it, and got error with using it. sorry i am just to confused, any idea? –  black_hat_cat Jan 6 at 23:49

1 Answer 1

Null byte injection in PHP concerns how null bytes are handled in filesystem operations. If an attacker can inject a null byte into a filepath, the underlying C function will disregard anything after the malicious character. This can be used in order to bypass constraints such as the intended file's extension.

The following example is from php.net:

<?php
$file = $_GET['file']; // "../../etc/passwd\0"
if (file_exists('/home/wwwrun/'.$file.'.php')) {
    // file_exists will return true as the file /home/wwwrun/../../etc/passwd exists
    include '/home/wwwrun/'.$file.'.php';
    // the file /etc/passwd will be included
}
?>

http://www.php.net/manual/en/security.filesystem.nullbytes.php

In this case, the '.php' extension will be ignored during file operations if the user submits a null character at the end of the file parameter. Combined with a directory traversal string, it allows the attacker to "include" arbitrary files that will be disclosed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.