What is php:// wrapper

• Accessing various I/O streams
• php://stdin, php://stdout, php://stderr
• php://input, php://output
• php://filter
• php://memory, php://temp, php://fd

Parameters of php://filter

• /resource=index.php
• /read=string.rot13
• /read=convert.base64-encode
• /write=zlib.deflate

Example

• php://filter/read=string.rot13/resource=https://sean.cat/

Lab: My Blog

StackOverflow?

And ChatGPT

What are those variables

• REMOTE_ADDR
• HTTP X-Forwarded-For
• HTTP Client-IP

Lab: Cloud Drive

CF-Connecting-IP

• Cloudflare CDN
• NginX: set_real_ip_from, real_ip_header

Recap: Path Traversal

NginX Config

Off-by-slash

Lab: Dynamic Pricing

XML Syntax

<?xml version="1.0" encoding="UTF-8"?>
<article>
	<title>我的第一篇文章！</title>
	<summary>這是我人生中的第一篇部落格文章！我感到非常興奮</summary>
</article>

XML Custom Entity

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE post [ <!ENTITY title "我的第一篇文章！" > ]>
<article>
	<title>&title;</title>
	<summary>這是我人生中的第一篇部落格文章！我感到非常興奮</summary>
</article>

XML External Entity

It could be external links

<!DOCTYPE xxe [
    <!ENTITY ext SYSTEM "http://cs.sean.cat/" >
]>

And could be local files

<!DOCTYPE xxe [
    <!ENTITY ext SYSTEM "file:///etc/passwd" >
]>

Lab: Import Blog Post

Slide

Refer to https://img.sean.taipei/2023/06/web-sec.pdf

Full Version: https://github.com/splitline/How-to-Hack-Websites/blob/master/slides/week/week3.pdf

Lab: WIP

Prototype Pollution

Q&A

投影片連結：https://hackmd.io/@Sean64/sec-sqlab2023

這份投影片以 創用 CC - 姓名標示 授權公眾使用，原始碼及講稿請見 此連結。