Full Path Disclosure - Revision history

Fredrik Nordberg Almroth at 21:28, 8 November 2012

2012-11-08T21:28:34Z

2012-11-08T21:24:51Z

2012-07-18T17:06:22Z

Added paragraph for "Invalid Session Cookies"

2011-08-29T12:50:00Z

Promote display_errors

2011-02-01T13:43:23Z

‎Examples

2010-12-25T12:58:08Z

‎References

2010-12-25T12:50:17Z

‎Examples

2010-12-25T12:49:30Z

‎Examples

2010-09-21T04:14:34Z

‎References

2010-09-21T04:13:44Z

‎References

@@ Line 26: / Line 26: @@
 </pre>
-An attacker crafts a URL like so: [http://site.com/index.php?page=../../../../../../../home/example/public_html/includes/config.php http://site.com/index.php?page=../../../../../../../home/example/public_html/includes/config.php]
+An attacker crafts a URL like so: [http://site.com/index.php?page=../../../../../../../home/example/public_html/includes/config.php http://site.com/index.php?page=../../../../../../../home/example/public_html/includes/config.php] with the knowledge of the FPD in combination with [https://www.owasp.org/index.php/Relative_Path_Traversal Relative Path Traversal].
 '''The leaked sourcecode of config.php:'''

@@ Line 11: / Line 11: @@
 ==Risk Factors==
-TBD
+The risks regarding FPD may produce various outcomes. For example, if the webroot is getting leaked, attackers may abuse the knowledge and use it in combination with file inclusion vulnerabilites (see [https://www.owasp.org/index.php/PHP_File_Inclusion PHP File Inclusion]) to steal configuration files regarding the web application or the rest of the operating system.
 ==Examples==

@@ Line 27: / Line 27: @@
 '''Null Session Cookie'''
-Another popular and very reliable method of producing errors containing a FPD is to give the page a nulled session using Javascript Injections.
+Another popular and very reliable method of producing errors containing a FPD is to give the page a nulled session using JavaScript Injections.
 A simple injection using this method would look something like so:
 <pre>javascript:void(document.cookie="PHPSESSID=");</pre>
@@ Line 38: / Line 38: @@
 Errors can contain useful information for site owner so instead of disabling the error reporting at all, it is possible to only hide errors from output by [http://www.php.net/errorfunc.configuration#ini.display-errors display_errors].
 '''Direct Access to files that requires preloaded library files'''

← Older revision		Revision as of 12:50, 29 August 2011
Line 36:		Line 36:
	This vulnerability is prevented simply by turning error reporting off so your code does not spit out errors.		This vulnerability is prevented simply by turning error reporting off so your code does not spit out errors.
	<pre>error_reporting(0);</pre>		<pre>error_reporting(0);</pre>
		+	Errors can contain useful information for site owner so instead of disabling the error reporting at all, it is possible to only hide errors from output by [http://www.php.net/errorfunc.configuration#ini.display-errors display_errors].

@@ Line 50: / Line 50: @@
 </pre>
-This kind of check can easily be done by developers with the aid of [https://code.google.com/p/inspathx/ inspathx] tool.
 ==Related [[Threat Agents]]==

@@ Line 76: / Line 76: @@
 * [http://www.enigmagroup.org/ Articled summarised from Full Path Disclosure article by haZed on EnigmaGroup.org.]
 * [http://yehg.net/lab/pr0js/view.php/path_disclosure_vulnerability.txt Path Disclosure Vulnerability - Is it serious?]
-* [http://yehg.net/lab/pr0js/files.php/inspath.zip inspath - Internal Path Disclosure Finder]
+* [http://yehg.net/lab/pr0js/files.php/inspath.zip inspathx - Internal Path Disclosure Finder]

@@ Line 36: / Line 36: @@
 This vulnerability is prevented simply by turning error reporting off so your code does not spit out errors.
 <pre>error_reporting(0);</pre>
 ==Related [[Threat Agents]]==

← Older revision		Revision as of 04:13, 21 September 2010
Line 61:		Line 61:
	* [http://www.enigmagroup.org/ Articled summarised from Full Path Disclosure article by haZed on EnigmaGroup.org.]		* [http://www.enigmagroup.org/ Articled summarised from Full Path Disclosure article by haZed on EnigmaGroup.org.]
	* [http://yehg.net/lab/pr0js/view.php/path_disclosure_vulnerability.txt Path Disclosure Vulnerability - Is it serious?]		* [http://yehg.net/lab/pr0js/view.php/path_disclosure_vulnerability.txt Path Disclosure Vulnerability - Is it serious?]
		+	* [http://yehg.net/lab/pr0js/files.php/inspath.zip inspath(Internal Path Disclosure Finder) ]