A lot of times,
people forget about old files that they have stopped using. Usually they are
renamed, including file extension, and just left on the server. This is a
terrible idea since this can lead to attackers being able to download these
files and viewing the source. For example, let's say we rename our config.php
file to config.php.old. Since the
renamed files is no longer a PHP file, an attacker can download it (due to the
extension change, the files is served as a plain/text rather than being executed on the server),
rename it back to config.php and view the contents. This is not limited to just
renaming files - often times, people leave backed up files on the server fully
accessible to the public. These backup
and or configuration files should be placed in areas of the server not
accessible from the web (out side of the public_html folder).
How do we prevent
this?
- Don't edit files on the live system. Edit locally, then upload via SSH or FTP.
- Setup a system to delete/move old backup and obsolete files.
- The web application should be made so that data, log, and configuration files are stored outside the public_html folder.
How do we look for
systems that can have this vulnerability?
First use a web
mirroring tool to setup local "version" of the site. Then using the
file names, try to infer the naming convention of certain files. For example,
if there is a adduser.php file, there could be a deleteuser.php file. Secondly, look at the comments of available
source code. Sometimes, users leave sensitive comments in files. Thirdly, use the robots.txt file (if exists)
to look for certain directories or files that the user does not want index by
search engines. A lot of times, you can find the administrator dashboard
directory in here. It is also a good idea to look for open directories that
might contain various different files. Some of these directories might contain
a backup or renamed file.
No comments:
Post a Comment