|
|
Posted by Kimmo Laine on 03/29/06 14:48
"Frank Mutze" <nospam@all.net> wrote in message
news:e0dk62$hkc$1@s1.news.oleane.net...
> hello
>
> Is there a method to forbid an attacker to exploit download.php
> in grabbing some "sensitive" file ?
>
> I mean using that kind of trick
>
> download.php?filename=../../../../../../../../../../../../etc/passwd
>
> thanks you
Jerry already suggested a good way, but you can also try it with a checksum
to see that you did generate the filename by recalculating the check.
Say you'r filename is 'validfile.pdf'. You calculate a checksum for it, for
example by prepending a static password and md5'ing it.
$filename = 'validafile.pdf';
$checksum = md5($filename.'supercalifragislisticexpialidocious');
Then echo the link:
download.php?filename=$validfile.pdf&checksum=$checksum
In download.php before outputting the file, you recalculate the checksum the
same way and compare it to given checksum
if($_GET[checksum] ==
md5($_GET[filename].'supercalifragislisticexpialidocious'))
if they match, it was indeed a link you generated and a file you generated,
but if it was changed to something like
filename=../../../../../../../../../../../../etc/passwd then the checksums
do not match (or at least the possibility of a false file name matching is
near to non-existing)
I used a scrambler 'supercalifragislisticexpialidocious' here, because
simply md5'ing the filename can be reproduced, but by adding the secret
scrambling key you also ensure that a hacker doesn't outsmart you by also
md5'ing his filename. Without the correct scrambling key the md5 will be
different, and since it's one-way function, you can not reproduce the
scrambling key from the md5 hash.
They way Jerry suggested is easier, but this is another way to achieve it.
--
"En ole paha ihminen, mutta omenat ovat elinkeinoni." -Perttu Sirviφ
spam@outolempi.net | Gedoon-S @ IRCnet | rot13(xvzzb@bhgbyrzcv.arg)
Navigation:
[Reply to this message]
|