Server-Side Filtering

File Extensions

In Server Side Filtering we have to perform a lot of testing to build up an idea of what is or is not allowed through the filter, then gradually put together a Payload.

• BurpSuite: We can Intercept the Request of Upload using BurpSuite and then pass is to Intruder to Perform Checks on which Extensions are Allowed. We can than Craft a PAYLOAD based on the Allowed File Types.
• Obfuscating File Extensions: The Server may only check if the File has .jpeg or .jpg in the Filename.
  • We can try to Upload a PAYLOAD like this: php-reverse.jpeg.php

• Vulnerable PHP Code

<?php
	$extension = pathinfo($_FILES["fileToUpload"]["name"])["extension"];
	switch($extension){
		case "php":
		case "phtml":
		case "phar":
		case "php3":
		case "php4":
		case "php7":
		case "phps":
		case "php-s":
		case "pht":
		case "phar":
		case NULL:
			$uploadFail = True;
			break;
		default:
			$uploadFail = False;
	}
?>

Magic Numbers

The magic number of a file is a string of hex digits, and is always the very first thing in a file. Knowing this, it's possible to use magic numbers to validate file uploads, simply by reading those first few bytes and comparing them against either a whitelist or a blacklist.

• We can Modify the First Digits of a File with a Hex Editor

┌────────┬─────────────────────────┬─────────────────────────┬────────┬────────┐
│00000000│ 3c 3f 70 68 70 0a 73 65 ┊ 74 5f 74 69 6d 65 5f 6c │<?php_se┊t_time_l│
│00000010│ 69 6d 69 74 20 28 30 29 ┊ 3b 0a 24 56 45 52 53 49 │imit (0)┊;_$VERSI│
└────────┴─────────────────────────┴─────────────────────────┴────────┴────────┘

• Transforming PHP File Into GIF using Magic Numbers: 47 49 46 38 37 61

┌────────┬─────────────────────────┬─────────────────────────┬────────┬────────┐
│00000000│ 47 49 46 38 37 61 0a 3c ┊ 3f 70 68 70 0a 73 65 74 │GIF87a_<┊?php_set│
│00000010│ 5f 74 69 6d 65 5f 6c 69 ┊ 6d 69 74 20 28 30 29 3b │_time_li┊mit (0);│
└────────┴─────────────────────────┴─────────────────────────┴────────┴────────┘

• Vulnerable PHP Code

<?php
	$finfo = finfo_open(FILEINFO_MIME_TYPE);
	$type = finfo_file($finfo, $_FILES["fileToUpload"]["tmp_name"]);
	finfo_close($finfo);
	if (strpos($type, "image/gif") !== false){
		$uploadFail = False;
	}
	else{
		$uploadFail = True;
	}
?>