Other nomination
Introducing lightyear: a new way to dump PHP files
Speeds up dumping files through a blind PHP file-read primitive: iconv charset conversions remap the base64 alphabet so a chosen digit becomes a newline, and PHP's lenient dechunk filter then strips everything before it. An attacker can pull tens of thousands of bytes with small payloads, six requests per digit, without raising PHP warnings.
Record
- Published by
- blog.lexfo.fr
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of blog.lexfo.fr, first published at the original source. Preserved copies are kept so the citation survives its host.