I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL:
http://127.0.0.1/download.php?file=file.txt&hash=[the valid md5 hash]
I'm trying to print out
/etc/passwd using this:
http://127.0.0.1/download.php?file=file.txt��/../../../etc/passwd&hash=[extended valid hash]
The backend first checks whether the provided MD5 is valid and then prints out the requested file. I'm using the PHP functions
fread for that.
I'm able to create valid hashes for arbitrary strings but PHP fails with the following error:
fopen()expects parameter 1 to be a valid path, string given in
Note: The characters
�� in the URL are due to the MD5 padding of the hash extension.