一、漏洞原理
1.1 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>核心
文件包含漏洞是指程序中需要包含其他文件(代码,信息等等),然而包含文件的路径受用户输入控制,攻击者可以使其包含恶意文件,从而造成敏感信息泄露甚至任意代码执行。分为两类:
- 本地文件包含(LFI, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Local <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>File <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Inclusion):攻击者能够让程序包含服务器本地文件(例如配置、日志、源码等)。
- 远程文件包含(RFI, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Remote <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>File <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Inclusion):程序支持包含远程位置的文件(通过 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>HTTP/FTP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等协议),可理解为可访问互联网上的内容,攻击者可能引入远程代码。
核心风险来自:被包含文件路径用户可控。
1.2 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>原理详解
文件包含有两个条件:
- 包含/读取:应用调用语言/框架的读取或包含函数(例如 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>include/require、Python <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>open/importlib、Node <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>fs.readFile/require <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等)。
- 路径用户可控:用户可通过修改url参数等方法控制被包含的文件路径。
达到这两个条件之后,文件包含漏洞就形成了。如果被包含文件不被解析执行,那么会造成敏感信息泄露。如果被包含文件被解析执行了,那么就会造成任意代码执行。
1.3 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>小例子
不安全示例
那么我通过GET方法访问 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>https://xxx.com/path/vulnerable.php?page=file_name <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>就可以访问执行任意文件。当然,前提是你知道对应文件路径(不知道的情况在2.2中说明)。
安全示例
这里使用白名单,避免了文件路径用户完全可控,就不造成文件包含漏洞了。推荐使用白名单而非黑名单。
二、检测与危害
2.1 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>检测方法
主要介绍人工检测方式而非工具使用。不仅是文件包含漏洞,文件读取漏洞也可以参考以下测试方法。
2.1.1 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>黑盒测试
- 找到对应接口/功能点
- 浏览应用页面与接口,着重关注那些接受“文件名、路径、模块、模板、页名、lang/theme、download、view”等参数的请求。
- 关注文件上传、文件查看、日志下载、动态模板选择、插件/主题加载、日志查看器等功能面,这类功能常与文件路径相关联。
- 记录每个入口的请求方法(GET/POST/头/表单/JSON)、参数名与参数位置(查询串、路径段、请求体、Headers、Cookies)。
- 构造输入类别并逐类测试
本步骤致力于发现是本地/远程文件包含,是否支持目录穿越,是否支持各种协议。对每一种变体,都要对比并记录:HTTP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>状态码、返回体长度、响应头(Content-Type、Server、X-Powered-By <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等)、页面内容差异与错误信息(堆栈、路径展示等)。
- 基础路径变体:提交看起来像文件/路径的字符串并观察是否有文件内容回显或与正常页面不同的错误/响应体(比如部分源码、配置项、路径错误信息等)。
- 目录穿越类变体:提交会导致解析为非预期目录的变体(包括编码变体、不同分隔符等),观察是否能访问应用根目录外的资源(用响应差异做推断)。
- 远程/协议类变体:尝试用不同的协议标识(本地 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>scheme、远程 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>scheme <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等)作为输入,观察应用是否尝试从外部获取资源或返回外部资源的内容(以判断是否允许远程包含)。
- 特殊文件类型变体:提交类似配置、日志或常见资源名的输入(按应用上下文判断),观察是否有信息泄露迹象。
- 协议测试:测试http/https, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>gopher, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>file, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>ftp, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>php协议等等,表见4.3
- 识别包含 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>vs <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>读取的迹象
- 直接内容回显:响应中出现了非预期的文本片段(例如源码片段、配置项、版本信息) <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>→ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>可能存在文件读取/包含。
- 错误/堆栈信息泄露:响应中包含文件系统路径、函数名或错误堆栈 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>→ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>程序在尝试访问文件并抛出异常,可能可被进一步利用或用于确认存在漏洞。
- 行为差异:对同一入口提交不同类别输入导致明显不同的响应(例如不同的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>HTTP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>头、长短、定制错误页面)→ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>表明服务器在对输入进行路径解析或文件操作。
- 外部依赖表现:在尝试“远程”类别时,如果出现网络延迟、外部错误或返回的内容明显来源于外部 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>→ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>说明应用可能支持从外部载入资源。
2.1.2 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>代码审计
- 必要条件审查
- 查找所有与包含/读取相关的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>API <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>调用(例如 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>include/require/require_once/include_once,Node <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>fs.readFile/require,Python <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>open/importlib <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等)。
- 追踪这些调用处传入的变量来源(是否直接来源用户输入或受外部影响)。
- 检查是否存在缺乏白名单、路径规范化或权限检查的路径拼接。
- 配置审查
- 检查运行时配置,是否允许远程包含(例如老式 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>allow_url_include)或是否将可写目录暴露给 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>web <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>进程。
- 审核文件/目录权限,避免 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>web <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>进程能够读写敏感路径。
2.2 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>利用与危害
- 信息泄露:被包含文件的内容可能包含密钥、配置、数据库凭据或源码注释等敏感信息;
- 代码执行:如果应用将包含当作可执行脚本(例如 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>include),并且攻击者能控制被包含文件的内容(或者包含远程可执行代码),可能导致远程代码执行(RCE);
- 链式攻击:文件包含常与目录穿越、文件上传、日志注入等漏洞连用,放大影响。尤其是文件上传,可以通过文件上传上传一个图片马并得到对应路径,之后使用文件包含漏洞包含图片马,图片马被解析之后就可以进行远程代码执行。
三、修复与绕过
3.1 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>修复方式
- 白名单优先
- 最可靠的做法是把可包含的文件限定为一份显式映射(例如键名 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>-> <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>绝对路径),不要直接使用用户输入作为路径部分。
- 路径规范化与根目录约束
- 在接受路径前先做规范化(例如解析绝对路径),然后验证该路径确实位于允许的根目录之下。对于存在符号链接的文件系统,考虑解析真实路径(realpath)再验证。
- 禁用远程包含
- 在运行时或应用配置中禁止包含远程 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>URL(如PHP)。
- 协议控制
- 禁用用不到的协议,比如gopher, <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>php协议等
- 最小权限原则
- Web <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>进程仅对其运行所需的文件与目录拥有读取/写入权限;配置文件、密钥、私有证书等应尽可能放在 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>web <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>用户不可直接访问的目录,并对访问做好权限控制。
3.2 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>绕过技巧
- 输入混淆:对于黑名单的防御手段。可以尝试通过 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>URL <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>编码、双重编码、大小写混淆或使用不同路径分隔符来绕过简单的字符串比较。
- %00截断:对于php搭建的网站且php版本小于5.3,可以尝试%00截断,例如
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?><?php
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?> <?php
- $file=$_GET['file'];
- include($file.".html");
- ?>$file=$_GET['file'];
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?> <?php
- $file=$_GET['file'];
- include($file.".html");
- ?>include($file.".html");
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?>?>
复制代码 可以使用https://xxx.com/path/vul.php?file=xxx.php%00 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>这样后面的.html就会被舍弃了,相当于直接访问xxx.php
3. <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>http/https截断:对于http/https协议,可以用?进行截断,例如- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?><?php
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?> <?php
- $file=$_GET['file'];
- include($file.".html");
- ?>$file=$_GET['file'];
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?> <?php
- $file=$_GET['file'];
- include($file.".html");
- ?>include($file.".html");
- <?php
- $file=$_GET['file'];
- include($file.".html");
- ?>?>
复制代码 可以使用https://xxx.com/path/vul.php?file=https://xxx.com/xxx.php? <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>这样后面的.html就会被舍弃了,相当于直接访问https://xxx.com/xxx.php
四、补充说明
4.1 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Windows <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Linux <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>敏感路径
4.1.1 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>windows
4.1.2 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Linux
4.2 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP协议用法
协议测试PHP版本allow_url_fopenallow_url_include用法file://>=5.2off/onoff/on?file=file://D:/soft/phpStudy/WWW/64/phpcode.txtphp://filter>=5.2off/onoff/on?file=php://filter/read=convert.base64-encode/resource=/index.phpphp://input>=5.2off/onon?file=php://input <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>【POST <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>DATA <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>】zip://>=5.2off/onoff/on?file=zip://D:/soft/phpStudy/WWW/file.zip%23phpcode.txtcompress.bzip2://>=5.2off/onoff/on?file=compress.bzip2://D:/soft/phpStudy/WWW/file.bz2
【or】
?file=compress.bzip2://file.bz2compress.zlib://>=5.2off/onoff/on?file=compress.zlib://D:/soft/phpStudy/WWW/file.gz
【or】
?file=compress.zlib://file.gzdata://>=5.2onon?file=data://text/plain,
【or】
?file=data://text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=
也可以:
?file=data:text/plain,
【or】
?file=data:text/plain;base64,PD9waHAgcGhwaW5mbygpPz4=4.3 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>各协议介绍表
协议 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>Wrapper描述(用途)常见于 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>LFI <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>RFI潜在影响(安全角度)备注 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>防御要点file://直接指定本地文件系统路径的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>scheme。LFI <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>主体(读取本地文件)信息泄露(本地敏感文件可被读取)验证路径、使用白名单、限制根目录;注意符号链接。http:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>https://通过 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>HTTP(S) <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>从远程服务器获取资源。RFI(远程包含)可导致远程代码注入/执行(若服务端执行包含内容)或泄露远程文件内容禁用远程包含(如 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>allow_url_include),限制出站访问,使用网络隔离。ftp:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>ftps://通过 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>FTP(S) <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>协议获取远程文件。RFI(远程包含)与 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>HTTP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>类似,可能引入远程代码或泄露禁用或限制外部协议访问;关闭未使用的传输扩展。gopher://古老协议,可发送任意字节流(历史上用于绕过某些过滤器以触发远程命令/行为)。RFI(历史上常被滥用作探测/链式利用)可用于触发特殊网络行为或与服务交互,提升利用场景复杂性防御时应阻断对非必要协议的访问;在网络层过滤出站协议。data:数据 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>URI,用于内联小型数据(Base64/URL <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>编码)。RFI/LFI <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>视实现而定可内联代码或内容,若被包含并解释可能导致执行或注入阻断 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>data <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>协议解析,或者在文件包含逻辑中明确拒绝含有 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>: <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的输入。php://(PHP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>专用 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper)PHP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>内置多种 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>stream <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper(php://filter、php://input、php://memory <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等)。LFI <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>相关(特别是 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>php://filter <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>用于读取源码/绕过保护)可导致源码泄露、从输入流读取内容或间接读出敏感信息在 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>中禁用远程包含;对包含字符串做严格白名单;审查是否需要 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>php://* <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>功能。php://filter可对流应用过滤器(例如 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>base64 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>编码输出),历史上用于将 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>源码编码后泄露。LFI(源码泄露场景)源码泄露、敏感信息暴露防护同上;限制可包含的文件类型与路径。php://input访问原始 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> OST <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>数据流(可用于某些上下文读取请求体)。LFI <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>辅助可在特定条件下配合其他漏洞造成影响在包含逻辑中拒绝非文件路径的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper。phar://PHP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的打包/归档访问 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper,可访问 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>phar <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>包内文件。LFI(若应用解析 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>phar <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>metadata)在特定条件下可触发对象反序列化或其它意外行为更新 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?> HP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>版本;限制可读目录并检查上传内容。zip:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>compress.zlib:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等归档/压缩 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper用于访问压缩包内文件或压缩流。LFI(在支持的环境下)可引导读取压缩包内敏感文件防止未授权上传或包含压缩内容;验证文件来源。expect://(PHP)可执行外部命令并把结果作为流返回(需 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>expect <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>扩展)。RFI/LFI(极危险)可导致命令执行(RCE)禁用相关扩展;彻底拒绝可执行类 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper。smb:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>smbs:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>sftp:// <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>/ <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>ssh2.sftp://通过网络文件共享(SMB、SFTP <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>等)访问远程文件。RFI(远程包含)远程代码/内容引入或敏感文件读取网络层限制对内部/外部文件共享的访问;最小化跨网段访问权限。data:(重复说明)(见上)———其它自定义或扩展 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper例如语言/平台或扩展新增的 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>stream <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper视情况而定取决于 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>的行为(可读取、执行、反序列化等)在依赖库/扩展中审查可用 <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>wrapper <?php
$file=$_GET['file'];
include($file.".html");
?><?php
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>$file=$_GET['file'];
<?php
$file=$_GET['file'];
include($file.".html");
?> <?php
$file=$_GET['file'];
include($file.".html");
?>include($file.".html");
<?php
$file=$_GET['file'];
include($file.".html");
?>?>列表并禁用不必要的扩展。感谢阅读,有问题欢迎评论。
来源:程序园用户自行投稿发布,如果侵权,请联系站长删除
免责声明:如果侵犯了您的权益,请联系站长,我们会及时删除侵权内容,谢谢合作! |