Lesson 4.4: Path traversal and command injection
Two ways a visitor's input reaches the operating system. Path traversal: a file name from the request, with ../ in it, climbs out of the intended folder and reads any file the web server can read. Command injection: input glued into a shell command adds commands of its own and runs them as the web server's user. The defences: basename and allowlists for files, validating input and avoiding the shell (or escapeshellarg) for commands, and least privilege for the user that runs PHP. In the lab you read /etc/passwd through the invoice download, run id through the label printer tool, fix both PHP files and prove the fixes.
20 min
You will learn to
- Explain path traversal and recognise ../ attacks
- Fix file access with basename or an allowlist
- Explain command injection and shell metacharacters
- Fix it by validating input and avoiding the shell
- Explain why the web server's user should have few rights
Key terms
- Path traversal
- Using ../ (or encoded forms like %2e%2e%2f) in a file name to leave the intended folder.
- Command injection
- Input placed into a shell command adds commands of its own.
- Remote code execution (RCE)
- An attacker can run their own code on the target machine over the network.
- basename
- Returns only the last part of a path: the file name without folders.
- Input validation
- Checking that input has the expected form (type, length, characters) before using it.
- escapeshellarg
- PHP function that wraps a value in quotes so the shell treats it as one argument.
← UDP and ICMP: fast messages and network signals · All lessons · Authentication, authorisation, accounting and MFA →