The third vulnerability that we looked at was the file inclusion.
And we looked at two types the local file exclusion, which allowed us to include any file on the system
and then read files which will cause a file disclosure vulnerability.
And then you'd be able to read any file on the server.
And then we looked at the remote file inclusion, which is very dangerous, which allowed us to include
any file from any web server.
So we were able to include PHP shells and then get connection from the target computer.
To prevent these.
First of all, make sure you prevent the remote file inclusion.
So just in case anything goes wrong, people can't include files from outside your server and you can
do that the same way we enabled it using the PHP Ironi by disabling the allow URL of open and allow
URL include.
And if we go here to our metasploit table, I'll just show you very quick.
So if we do.
Pseudo nano, which is the text editor, TCP IP PHP that in the same file that we used.
This is the file for the PHP settings.
If you open that file.
And now I'm going to do control w.
And look for.
Allow your URL.
And you want to make sure that they allow you all of openness set to off.
And allow URL include is set to offer as well.
To control x, y and enter and that will save it for you.
The other way to prevent these exploits is to use static file inclusion.
So instead of using dynamic file inclusion, which we see in you can hard code the files that you want
to include in the code and not get them using, get or post.
For example, what's happening in the examples we see in the vulnerable examples is we have a page called
page or index that PHP.
And then this index PHP takes a parameter called page and then it takes another page.
For example, news dot free and it includes this news php in the code.
So what's the code look like in the code?
You'll see something like include.
So what this will do basically and that looks like this I believe what this do it includes.
Whatever comes after the page parameter.
So the code will dynamically take whatever that comes in after the page parameter and includes it in
the current page.
So this will be in the index, the PHP page.
This is very bad because even if it's not good, sometimes people use post and in post you won't see
this.
So it will be posted.
But you can use a proxy such as burp proxy and this would look like that.
And then you can modify it and get it to include anything you want and then it's displayed on the page.
What we really want to do is we want the user not to be able to manipulate with what's going to be included.
So if you want it to include a page called News dot PHP, just include it inside this without giving
the user the ability to change it.
I know you're going to program your code to just have it looking like this, but the users we know,
we see how users can play with this and just get it to include anything they want.
So the best way to do it is just to get it to include page dot PHP.
So your code is not using any variables.
It's it's hardcoded.
It might make your code log longer, but it's much more secure.
And this is exactly what the high security option does.
So let's go back to the file inclusion first and we're at the low.
And if I view the source now, you'll see that basically file is what you pass to it.
So file is what we pass to it in here and the after the page parameter and you can see that it tries
to display anything that we send it.
So when we send it, it's password, it shows us the ETSI password.
Now I'm actually going to keep this open and I'm going to go to the security level to the security,
and I'm going to set it to high.
Now the medium is similar to the low.
So you can actually use the same.
You can exploit it the same way that we exploited the low.
So we're going to the high straight away and we're going to view the source.
And I'm just going to minimize this because I have the two sources now so we can compare them.
So as you can see here in the low and medium security level, you can see that anything we pass to the
file variable, it will be displayed to us.
Whereas in here at the high security level, you can see that it is hardcoded, that it is only allowed
to show us the include the PHP file.
So you can you can modify this if statement if you had a number of files that you wish to include,
then you can allow them in here or you can have them in a list.
But basically the concept is you only allow the files that the user is allowed to see.
So you can just have them in a list here.
You can use an or statement or you can just have a list and say if the file is in this list, then display
it.
Otherwise give an error saying the file is not found.
So avoid this go with the hardcoded method.
Yes, it doesn't look as pretty as this, but it's much more secure.