Penetration of the road base - file contains

Local Inclusion Vulnerabilities

PHP Common Functions

• include()

  <?php
  $file=$_GET['f'];
  include($file);
  ?>

File Inclusion Vulnerabilities principle: the use of the function include the execution site server's file

Want to access testoutside of the phpinfo.phpfile can be accessed

Vulnerability produce :

1. Controllable variable $ file
2. Use the function include
3. Other functions include_once, requice, requice_once
4. View website URL registered members, and features such as uploading pictures
5. Upload backdoor file format is not suitable for horse pictures

• include_once()

• require_once()

• fopen()

• readfile()

jsp/Servlet

• java.io.File ()
• java.io.filereader()

asp

• include file
• include virtual

Remote contain loopholes

Remote contains settings

php.ini Security Settings

The current is turned off

Try to perform a remote Baidu Logo examples include:

After opening the switch, comprising the successful logo Baidu

Under certain circumstances, you can bypass the remote server that contains security dog

In fact, there are a lot of knowledge, can all be common to digest
the most important is the actual situation, this is just my study notes, there are many not expand out, for reference only