Hot answers tagged

20

It is not clear from your description why you want block these files exactly. I see the following possibilities: You want to block files that might infect the server itself. Unfortunately this can be about anything: shell, perl, python, awk, ... and of course compiled binaries. But to get these files executed without explicitly calling them with an ...


12

Don't block any specific MIME types. Block any kind of execution of the uploaded files. A simple way is to store uploaded files outside of the web root and serve them via scripting. If that's not possible, store files in a subdirectory and configure your server not to execute any scripts in that directory. Remember to do this for any scripting language that ...


8

The correct approach is to use the tools of your framework (and its template engine, if available). If you find yourself fiddling with inline PHP inside JS strings, chances are you make life harder and more dangerous than necessary. In plain PHP, a common approach is to use json_encode() as explained here. var foo = <?php echo json_encode($foo, ...


5

Are there any other filetype that I also should block? It doesn't matter, as finfo_file can be bypassed, see for example here: Encoding Web Shells in PNG IDAT chunks. mime_content_type doesn't seem to be more reliable either. You need to check for file extension in addition to the mimetype check, as it is a lot more reliable, as file names are a lot ...


5

Regardless of the placement of the PHP code [...], the website just shows the image file when I open it after uploading Yes, that is how it should be. The server would be seriously vulnerable if it would interpret .jpg files as .php files depending on the content instead of the extension. So in such a case, what should be done to execute the file ...


5

Generally there are two ways you can upload a shell to a server. Use RFI to execute PHP script that places shell You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways. Use FTP/HTTP/... module of php to download the shell from a ...


3

tim is right. The exploit uses %0D%0A%20, which is URL-decoded to CR + LF + SPACE and thanks to the extra space could bypass the response splitting protection in some browsers. There was once a feature called line folding, that allowed HTTP headers to span over multiple lines by prepending every additional line with a space or tab. It was later dropped in ...


2

I suggest a short-term quarantine of all uploaded files. You can use local systems scanning and AV tools in a temporary jail. This way you could add a routine to scan for malicious files and ignore all the different names of files. This stops the whack-a-mole game. This would add some latency to the application. I know this is not a coding solution but it ...


2

You should never allow redirection to a relative path that can be manipulated on the client side. As you say, it's dangerous as it potentially allows access to files outside of your webroot. A better approach is to "tag" or name the target pages and redirect to them inside your code. For example, when a user triggers a form, let it post redirpage with a ...


2

Disable exec and suexec, enable open_basedir and basically follow every suggestion in this post. You mentioned still there are other ways to... if after reading that post you still have questions or weaknesses, please post them here or in Serverfault


2

You should not attempt to create your own crypto algorithm for production use. Creating crypto systems is work for highly specialised teams of cryptographers, but everybody needs to start somewhere off course. ^_^ Instead, use a well known cryptographic algorithm. If at all possible (and it is possible), use a class that encapsulates all the configuration ...


2

The statement in that form is false. You can use any method for PHP object injection. The important point is that the method must actually be called. The advantage of magic methods is that they are all named the same, and __wakeup and __destruct are both automatically called. In this specific case, rewind works as it's called as part of the iterator in ...


2

You can set a cookie when the user requests watchvideo.php, containing a hash of values identifying the client, like user agent, IP address, and so: <?php $ip = $_SERVER['REMOTE_ADDR']; $browser = implode(':', $_SERVER['HTTP_USER_AGENT']); $userFingerprint = md5($browser . $ip); setcookie('userdata', $userFingerprint, time() + 10); //expires in 10 ...


2

I don't think that you can do anything with just this code. But that does not mean that this is secure in any way. You give up the control flow of your application to the user, which is not a good idea. For example, if you were to call close on the newly created object, an attacker would gain SSRF: $obj = new $_GET['x']($_GET['y']); $obj->close(); // ...


1

I assume you want to know if there is a way to execute the uploaded PHP file. Short Answer: No Long Anwser: As long as the web server is configured correctly only .php files gets executed as PHP. Most web servers will return as content type always the mime type derived from the file extension. The content itself of the HTTP response is typically the content ...



Only top voted, non community-wiki answers of a minimum length are eligible