Skip to content

Topic Introduction

This week we will be looking at Remote Code Execution and File Includes attacks. These are injection like attacks where we are able to "Include" external content in a website by exploiting the sites built in functionality.

For example, we might make use of broken templating to load files from elsewhere in the system onto the live version of the site.

Like the XSS vulnerabilities we looked at last time, these isues allow us to execute code. However, unlike XSS which executes on the client, these will execute on the server, meaning that a full systems exploit may be possible.

We will also look at how RCE can happen through insecure deserialisation.

Topics for the Week

  • File Includes
    • LFI (Traversal)
    • RFI
    • LFI (Exploit)
  • [x ] Unsecure Uploads
  • RCE
  • [x ] Insecure Deserialization

Question of the Week

Discuss

There are lots of interesting include style vulnerbilities in the list of CVE's Use the feed on aula to talk about the most interesting one you have seen

Back to top