Hello.
we'll see in this session two laboratories related to local file inclusion and remote file inclusion.
Let's start from local file inclusion lab. In this page through the Load button the content of
a static HTML page is loaded with postback to the page itself.
So let's see, which static page I refer to.
The page that loads is the datiLFI.html with this static content, you see.
This page is inside the virtual directory of the Web application.
And this is the behaviour that the programmer would expect that is loading the content of this static page.
If the vulnerability is present
What can the malicious attacker do, a malicious attacker can change the path value of the file to
be loaded, assigned to the ID parameter.
Going to insert a local path inherent to a file present on the server, when the page is reloaded, its content
is seen.
In this way, the malicious attacker knowing files in known positions on the server's file system, could read
the contents at will.
OK.
Let's see how we can remedy this vulnerability.
Let's go to the source code of the page that processes the content of the static file.
And
We can
uncomment a Switch construct that verifies that the file to be loaded falls into a white-list
of admissible paths, in any other case, the file is not loaded.
Now, let's try to rerun the laboratory, having applied the mitigation.
And we should see that the access to unexpected files will no longer be possible.
So let's see, i run the laboratory again.
And I try again the malevolent injection of an illegal path, but as you can see this time, the
attack is not successful, and the content of the illegal file is no longer accessible.
We can also see a similar example for the remote file inclusion vulnerability.
The programmer expects to load again the same static page, but in the form of a URL. The
URL that the programmer expects is that of the application.
But if RFI vulnerability is present, a malicious attacker
could force the application to load the resource from a remote URL
So we can try to inject a remote URL and force the application to load that resource.
And.
Here, is the result.
You can see now.