Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Docs for PHP Object Injection Emulator #329

Merged
merged 2 commits into from
Jun 8, 2019
Merged

Docs for PHP Object Injection Emulator #329

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
834d954
docs added
rjt-gupta Jun 8, 2019
90bc55e
vuln code info
rjt-gupta Jun 8, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions docs/source/emulators.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,21 @@ It emulates `PHP code injection`_ vuln. Usually, this type of vuln is found wher
functions like eval, assert. To mimic the functionality, user input is converted to the following code
``<?php eval('$a = user_input'); ?>`` and then passed to phpox to get php code emulation results.

PHP Object Injection Emulator
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add information that user need have its own method to expose the code about class itself for now. And also add a link to `vuln_code stating this is the default code but you can add your own class here.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
It emulates `PHP object injection`_ vuln. PHP allows object serialization So, this type of vulnerability occurs when not
properly sanitized input is passed to unserialize() PHP function. Exploiting this vulnerability involves Magic methods like
``__destruct or __construct`` which are called automatically when an object is created or destroyed and methods like
``__sleep or __wakeup`` are called when an object is serialized and unserialized. The input serialized object is
detected with regex pattern.

::

(^|;|{|})O:[0-9]+:

To mimic this functionality the user input is injected to a vulnerable custom class with magic methods and then it
is passed to php sandbox to get the injection results.

CRLF Emulator
~~~~~~~~~~~~~
It emulates `CRLF`_ vuln. The attack is detected using ``\r\n`` pattern in the input. The parameter which looks suspicious
Expand All @@ -100,5 +115,6 @@ is injected as a header with parameter name as header name and param value as he
.. _SQL injection: https://en.wikipedia.org/wiki/SQL_injection
.. _Command Execution: https://www.owasp.org/index.php/Command_Injection
.. _PHP Code Injection: https://www.owasp.org/index.php/Code_Injection
.. _PHP object injection: https://www.owasp.org/index.php/PHP_Object_Injection
.. _CRLF: https://www.owasp.org/index.php/CRLF_Injection
.. _manual: https://github.com/client9/libinjection/wiki/doc-sqli-python