Add Local File Inclusion Vulnerability #293

Ivan12273 · 2021-07-01T23:45:27Z

Hi!, I was working on the issue #286 I added the Local File Inclusion to the project:

It has two level:

Direct url param injection
Direct url param injection with null byte character

It works similar to Remote File Inclusion, when the user find the folder with the password file it will return the following:

When the users clicks on the hyperlink they will go to the next level:

The users can see the secret data if they successfully performs the vulnerability:

I also made some fixes, these hyperlinks were sending you to broken links when clicking on them, so I added "/ VulnerableApp" to fix them.

And the GitHub icon wasn't on the project so I added it too:

Greetings, I hope these changes are ok :)

preetkaran20 · 2021-07-02T09:25:38Z

src/main/resources/static/index.html

@@ -86,8 +86,8 @@ <h2>How can Vulnerability Scanning Tools use VulnerableApp?</h2>
 				<br/>
 				<b>Following are the endpoints exposed: </b>
 				<ol>
-				<li><a href="/scanner">Scanner Endpoint</a></li>
-				<li><a href="/sitemap.xml">SiteMap Endpoint</a></li>
+				<li><a href="/VulnerableApp/scanner">Scanner Endpoint</a></li>


Thanks a lot this fix.

preetkaran20 · 2021-07-02T09:25:54Z

src/main/resources/static/index.html

@@ -22,7 +22,7 @@
 		<!-- TODO Add active to mode when clicked-->
 		<div class="navbar navbar-item">
 			<div class="navbar-item-menu active" id="home">
-				<a href="/">Home</a>
+				<a href="/VulnerableApp">Home</a>


Thanks a lot for the fix.

preetkaran20

Hi @Ivan12273,

Thanks for the PR, however, I have few suggestions:

we should create a UI where users can give input and that input causes LFI. Something similar to what we have for Command Injection or other vulnerability levels.
For creating a UI, we need a particular theme such that users related to real-world LFI vulnerabilities. For this, have a look at other vulnerable applications such as DVWA.
Please add more Vulnerability levels associated with Blacklist, wrongly implemented whitelisting, different protocol bypasses, and 1 or 2 secure implementations such that we can better judge a scanner.

thanks,
Karan

preetkaran20 · 2021-07-02T09:35:27Z

src/main/resources/static/index.html

@@ -31,7 +31,7 @@
 				Mode
 			</div>
 			<div class="navbar-item-menu">
-				<a href="https://github.com/SasanLabs/VulnerableApp" target="_blank"><img src="/images/GitHub-Mark-32px.png" /></a>
+				<a href="https://github.com/SasanLabs/VulnerableApp" target="_blank"><img src="images/GitHub-Mark-32px.png" /></a>


Ivan12273 · 2021-07-02T14:47:18Z

Hi @Ivan12273,

Thanks for the PR, however, I have few suggestions:

we should create a UI where users can give input and that input causes LFI. Something similar to what we have for Command Injection or other vulnerability levels.

For creating a UI, we need a particular theme such that users related to real-world LFI vulnerabilities. For this, have a look at other vulnerable applications such as DVWA.

Please add more Vulnerability levels associated with Blacklist, wrongly implemented whitelisting, different protocol bypasses, and 1 or 2 secure implementations such that we can better judge a scanner.

thanks,
Karan

Hello @preetkaran20 then it would be fine if I add an input where the user write the url?
I see that if I try to write an url param like this: http://localhost:9090/VulnerableApp?file=[something] the app sends me to the home view, so I was thinking on an input as the command injection one but longer where if the user types a path with a different file, the application shows the content below the input.

preetkaran20 · 2021-07-02T15:33:44Z

Hi @Ivan12273,
Thanks for the PR, however, I have few suggestions:

we should create a UI where users can give input and that input causes LFI. Something similar to what we have for Command Injection or other vulnerability levels.

For creating a UI, we need a particular theme such that users related to real-world LFI vulnerabilities. For this, have a look at other vulnerable applications such as DVWA.

Please add more Vulnerability levels associated with Blacklist, wrongly implemented whitelisting, different protocol bypasses, and 1 or 2 secure implementations such that we can better judge a scanner.

thanks,
Karan

Hello @preetkaran20 then it would be fine if I add an input where the user write the url?
I see that if I try to write an url param like this: http://localhost:9090/VulnerableApp?file=[something] the app sends me to the home view, so I was thinking on an input as the command injection one but longer where if the user types a path with a different file, the application shows the content below the input.

Didn't get your question fully, however, I would suggest not take URL as input because that doesn't seem like a real-world use case, check some applications like DVWA, etc to see how are they taking the input.

We are fine with showing the output below the input.

Ivan12273 · 2021-07-03T20:11:56Z

Hello @preetkaran20 I did something similar as DVWA, this is how it works:

I added a button for verify the URL:

For the first level if the user writes a path like this http://localhost:9090/VulnerableApp/?file=secretFiles/passwords.txt this is going to happen:

In other cases the app will show:

I was only able to add another blacklist vulnerability and a secure implementations, sorry, I hope that's okay.

Best regards!

preetkaran20 · 2021-07-04T03:07:27Z

Hello @preetkaran20 I did something similar as DVWA, this is how it works:

I added a button for verify the URL:

For the first level if the user writes a path like this http://localhost:9090/VulnerableApp/?file=secretFiles/passwords.txt this is going to happen:

In other cases the app will show:

I was only able to add another blacklist vulnerability and a secure implementations, sorry, I hope that's okay.

Best regards!

@Ivan12273,
one question, Does the user need to add a query param for input? I think we should add an input box. Adding the input to query param of a single page application doesn't seems right.

Ivan12273 · 2021-07-04T14:18:49Z

Hello @preetkaran20 I did something similar as DVWA, this is how it works:
I added a button for verify the URL:

For the first level if the user writes a path like this http://localhost:9090/VulnerableApp/?file=secretFiles/passwords.txt this is going to happen:

In other cases the app will show:

I was only able to add another blacklist vulnerability and a secure implementations, sorry, I hope that's okay.
Best regards!

@Ivan12273,
one question, Does the user need to add a query param for input? I think we should add an input box. Adding the input to query param of a single page application doesn't seems right.

Alright, I will change it for an input box.

Ivan12273 · 2021-07-04T16:30:53Z

@preetkaran20 Hi again, I changed it for the input box :)

preetkaran20 · 2021-07-04T17:11:22Z

@preetkaran20 Hi again, I changed it for the input box :)

I don't think input as a URL to an application for LFI is right. It might be the case for RFI or SSRF. For LFI we just need file name only.

As we see in DVWA, a PHP file is included based on an input parameter. My suggestion is to think of a use case first. Please go through some use cases from multiple places like https://www.neuralegion.com/blog/local-file-inclusion-lfi/ or https://www.netsparker.com/blog/web-security/local-file-inclusion-vulnerability/.

An example use-case at the top of my mind is:
Say we want to show a page with images and the image name goes as an input to the application. Now if that image name is modified then that can cause LFI.

Code:

<img src="http://localhost:8080/LFI/?filename=image1.png" />
<img src="http://localhost:8080/LFI/?filename=image2.png" />

Now in this, user can change filename as "/etc/passwd" and that can cause LFI.

You are free to ignore my suggested example usecase.

Earlier Input box suggestions was little wrong from my side as there is nothing much we can do with input box.

preetkaran20 · 2021-07-04T17:34:50Z

src/main/java/org/sasanlabs/service/vulnerability/lfi/secretFiles/passwords.txt

@@ -0,0 +1,6 @@
+<h2>TOP SECRET PASSWORDS</h2>
+


I think we don't need a special file, use /etc/passwd and equivalent for windows.

preetkaran20 · 2021-07-04T17:40:06Z

src/main/resources/static/templates/LocalFileInclusion/LEVEL_1/LFI.html

+        sanitized, allowing directory traversal characters (such as dot-dot-slash)
+        to be injected.
+        <br /> <br />
+        Try to find the password file inside the secretFiles folder using the URL param: <i>file</i>


This line sounds like a challenge, which doesn't align with our vulnerable applications mission. Consider this application as a general application which has flaws and let scanners explore and find them.

Yes, I will change it.

preetkaran20 · 2021-07-04T17:41:36Z

src/main/java/org/sasanlabs/service/vulnerability/lfi/LFIVulnerability.java

+                    data = data + reader.nextLine();
+                }
+                payload.append(data);
+                reader.close();


Please close the reader in finally block or better use try with resourcr

preetkaran20 · 2021-07-04T17:42:16Z

src/main/java/org/sasanlabs/service/vulnerability/lfi/LFIVulnerability.java

+            value = LevelConstants.LEVEL_2,
+            descriptionLabel = "LFI_URL_PARAM_BASED_INJECTION_WITH_VALIDATION_ON_FILE",
+            htmlTemplate = "LEVEL_1/LFI")
+    public ResponseEntity<String> getVulnerablePayloadLevelUnsecureLevel2(


Please try queryparam by name injection instead of map.

preetkaran20 · 2021-07-04T17:45:44Z

src/main/java/org/sasanlabs/service/vulnerability/lfi/LFIVulnerability.java

+                        new File(
+                                "src/main/java/org/sasanlabs/service/vulnerability/lfi/"
+                                        + queryParameterURL);
+                Scanner reader = new Scanner(file);


Is scanner the best way to read file?

Not sure, do you have a suggestion?

May be buffered reader but not sure if there are any new libraries which can be more better. Please check.

Ivan12273 · 2021-07-07T20:02:13Z

@preetkaran20 Hi again, I changed it for the input box :)

@preetkaran20 Hi again, I changed it for the input box :)

I don't think input as a URL to an application for LFI is right. It might be the case for RFI or SSRF. For LFI we just need file name only.

As we see in DVWA, a PHP file is included based on an input parameter. My suggestion is to think of a use case first. Please go through some use cases from multiple places like https://www.neuralegion.com/blog/local-file-inclusion-lfi/ or https://www.netsparker.com/blog/web-security/local-file-inclusion-vulnerability/.

An example use-case at the top of my mind is:
Say we want to show a page with images and the image name goes as an input to the application. Now if that image name is modified then that can cause LFI.

Code:
<img src="http://localhost:8080/LFI/?filename=image1.png" />
<img src="http://localhost:8080/LFI/?filename=image2.png" />
Now in this, user can change filename as "/etc/passwd" and that can cause LFI.

You are free to ignore my suggested example usecase.

Earlier Input box suggestions was little wrong from my side as there is nothing much we can do with input box.

Alright!, then you suggest an input box only for the param, I will take this usecase, it is fine?

preetkaran20 · 2021-07-08T03:18:11Z

Alright!, then you suggest an input box only for the param, I will take this usecase, it is fine?

ok, can you please check if this use-case is feasible or not? You need to do a little more research on this.

Ivan12273 · 2021-07-13T19:00:15Z

Alright!, then you suggest an input box only for the param, I will take this usecase, it is fine?

ok, can you please check if this use-case is feasible or not? You need to do a little more research on this.

Hi @preetkaran20 sorry for the delay, I did a research about this use-case, is feasible, it would be the same idea as this scenario but with an input for the images:

It occurred to me an use case where the user can change the file name of an image, for example: an user can select one image with a select input, once selected he can write in an input text the new name of the image, when the user press submit the app will show the image with a successful message. This will be the "normal" case.

In the other case, the user write a new name with a path like: "/etc/passwd", and when the user press submit the app will show the passwd info.

What do you think about this approach?

preetkaran20 · 2021-07-14T18:23:07Z

Alright!, then you suggest an input box only for the param, I will take this usecase, it is fine?

ok, can you please check if this use-case is feasible or not? You need to do a little more research on this.

Hi @preetkaran20 sorry for the delay, I did a research about this use-case, is feasible, it would be the same idea as this scenario but with an input for the images:

It occurred to me an use case where the user can change the file name of an image, for example: an user can select one image with a select input, once selected he can write in an input text the new name of the image, when the user press submit the app will show the image with a successful message. This will be the "normal" case.

In the other case, the user write a new name with a path like: "/etc/passwd", and when the user press submit the app will show the passwd info.

What do you think about this approach?

Yeah, this use case looks good however it is not very clear to me. Can you please elaborate more?
My thought was somewhat same as the example use case, i.e. we just create a gallery of images and each image is shown like <img src=http://localhost:.../LFI?param=image1.png />. If the user opens this URL directly in a new tab, the user will get the image and if the user tweaks the param value to http://localhost:.../LFI?param=/etc/password he should be able to see the contents of the directory.

Also if possible let's connect over a call to discuss? I work in IST time zone from 10 AM IST to 10 PM IST. Please let me know your preferred timings.

Ivan12273 · 2021-07-16T00:46:12Z

Alright!, then you suggest an input box only for the param, I will take this usecase, it is fine?

ok, can you please check if this use-case is feasible or not? You need to do a little more research on this.

Hi @preetkaran20 sorry for the delay, I did a research about this use-case, is feasible, it would be the same idea as this scenario but with an input for the images:

It occurred to me an use case where the user can change the file name of an image, for example: an user can select one image with a select input, once selected he can write in an input text the new name of the image, when the user press submit the app will show the image with a successful message. This will be the "normal" case.
In the other case, the user write a new name with a path like: "/etc/passwd", and when the user press submit the app will show the passwd info.
What do you think about this approach?

Yeah, this use case looks good however it is not very clear to me. Can you please elaborate more?
My thought was somewhat same as the example use case, i.e. we just create a gallery of images and each image is shown like <img src=http://localhost:.../LFI?param=image1.png />. If the user opens this URL directly in a new tab, the user will get the image and if the user tweaks the param value to http://localhost:.../LFI?param=/etc/password he should be able to see the contents of the directory.

Also if possible let's connect over a call to discuss? I work in IST time zone from 10 AM IST to 10 PM IST. Please let me know your preferred timings.

Hello @preetkaran20 I am so sorry, it seems that for now I will not have enough time to continue with this, I will probably be available in the future but at the moment it is complicated.
If you want I can close the PR or leave it open.
Sorry again I whish I could helped more :(

preetkaran20 · 2021-07-16T03:06:30Z

Hi @Ivan12273,

No problem. No need to close the PR, we will pick this issue from here only. Thanks a lot for the contribution.

thanks,
Karan

Local File Inclusion Vulnerability and fixes

9563b12

preetkaran20 reviewed Jul 2, 2021

View reviewed changes

preetkaran20 requested changes Jul 2, 2021

View reviewed changes

preetkaran20 reviewed Jul 2, 2021

View reviewed changes

New levels and UI changed

4520651

Input box for LFI vulnerability

0e67f14

preetkaran20 requested changes Jul 4, 2021

View reviewed changes

preetkaran20 reviewed Jul 4, 2021

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Local File Inclusion Vulnerability #293

Add Local File Inclusion Vulnerability #293

Ivan12273 commented Jul 1, 2021

preetkaran20 Jul 2, 2021

preetkaran20 Jul 2, 2021

preetkaran20 left a comment

preetkaran20 Jul 2, 2021

Ivan12273 commented Jul 2, 2021 •

edited

Loading

preetkaran20 commented Jul 2, 2021 •

edited

Loading

Ivan12273 commented Jul 3, 2021

preetkaran20 commented Jul 4, 2021

Ivan12273 commented Jul 4, 2021 •

edited

Loading

Ivan12273 commented Jul 4, 2021

preetkaran20 commented Jul 4, 2021 •

edited

Loading

preetkaran20 Jul 4, 2021 •

edited

Loading

preetkaran20 Jul 4, 2021

Ivan12273 Jul 7, 2021

preetkaran20 Jul 4, 2021

Ivan12273 Jul 7, 2021

preetkaran20 Jul 4, 2021

preetkaran20 Jul 4, 2021

Ivan12273 Jul 7, 2021

preetkaran20 Jul 8, 2021 •

edited

Loading

Ivan12273 commented Jul 7, 2021

preetkaran20 commented Jul 8, 2021

Ivan12273 commented Jul 13, 2021

preetkaran20 commented Jul 14, 2021 •

edited

Loading

Ivan12273 commented Jul 16, 2021

preetkaran20 commented Jul 16, 2021

Add Local File Inclusion Vulnerability #293

Are you sure you want to change the base?

Add Local File Inclusion Vulnerability #293

Conversation

Ivan12273 commented Jul 1, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

preetkaran20 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Ivan12273 commented Jul 2, 2021 • edited Loading

preetkaran20 commented Jul 2, 2021 • edited Loading

Ivan12273 commented Jul 3, 2021

preetkaran20 commented Jul 4, 2021

Ivan12273 commented Jul 4, 2021 • edited Loading

Ivan12273 commented Jul 4, 2021

preetkaran20 commented Jul 4, 2021 • edited Loading

preetkaran20 Jul 4, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

preetkaran20 Jul 8, 2021 • edited Loading

Choose a reason for hiding this comment

Ivan12273 commented Jul 7, 2021

preetkaran20 commented Jul 8, 2021

Ivan12273 commented Jul 13, 2021

preetkaran20 commented Jul 14, 2021 • edited Loading

Ivan12273 commented Jul 16, 2021

preetkaran20 commented Jul 16, 2021

Ivan12273 commented Jul 2, 2021 •

edited

Loading

preetkaran20 commented Jul 2, 2021 •

edited

Loading

Ivan12273 commented Jul 4, 2021 •

edited

Loading

preetkaran20 commented Jul 4, 2021 •

edited

Loading

preetkaran20 Jul 4, 2021 •

edited

Loading

preetkaran20 Jul 8, 2021 •

edited

Loading

preetkaran20 commented Jul 14, 2021 •

edited

Loading