Auditing PHP Applications for Local File Disclosure Vulnerabilities

Searching for vulnerabilities using grep

You can search for these function using the grep utility. you can also specify the patterns in a file grep will read from. this is a good way to match mutiliple patterns over multiple files.

This is the contents of our patterns.txt file:

include(
include_once(
require(
require_once(
file_get_contents(
readfile(
fread(
fgets(

Command: grep -f patterns.txt -r -n /path/to/dir

The 'r' option tells grep to read all files in the directory , while the 'n' option tells grep to output line numbers

sam@ubuntu:~/public_html$ grep -f patterns.txt -r -n file_upload_audit/
file_upload_audit/include.php:3:include($file);
file_upload_audit/fgets.php:6: echo fgets($fh);
file_upload_audit/get-cont.php:4:echo file_get_contents($file);
file_upload_audit/readfile.php:4:readfile($file);
file_upload_audit/fread.php:5:echo fread($fh,filesize($file));
sam@ubuntu:~/public_html$

include(),include_once(),require(),require_once()

<?php
 $file = $_GET['file'];
 include($file);
?>

Final URL:

http://localhost/~sam/include.php?file=/etc/passwd

file_get_contents()

the file_get_contents functions takes a path to a file as is argument and returns the output of the file in a string format. You can include files through this function just like the include and require functions above.

<?php
 $file = $_GET['file'];
 echo file_get_contents($file);
?>

Final URL:

http://localhost/~sam/get-cont.php?file=/etc/passwd

readfile()

the readfile() function simply reads a file and writes it to output. If you can control what goes in to read file a local file inclusion can occur.

<?php
 $file = $_GET['file'];
 readfile($file);
?>

fread()

fread function take a resource created by fopen which fread then reads the file and outputs the result. This too can be vulnerable to a local file inclusion if the input isnt sanitized.

<?php
$file = $_GET['file'];
$fh = fopen($file,"r");
echo fread($fh,filesize($file));
fclose($fh);
?>

fgets()

fgets function is like the fread function above. fgets takes a resource from fopen and returns the result of the file being read line by line.

<?php 
$file = $_GET['file'];
$fh = fopen($file,"r");

while (!feof($fh)) {
 echo fgets($fh);
}

fclose($fh);
?>