Other nomination
Scanning internal Lan with PHP remote file opening.
Stefano Di Paola turns a non-inclusion PHP wrapper sink such as getimagesize($_GET['image']) into an internal network scanner. Open and closed ports are told apart by the wording of the failed-to-open-stream warning, or by response timing when errors are suppressed, over http:// or ftp://. Enables drive-by pharming, router brute force and full LAN scans, with HTTP Basic auth supported.
Record
- Researcher
- Stefano Di Paola
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Stefano Di Paola, first published at the original source. Preserved copies are kept so the citation survives its host.