permalink: spells/poison-null-byte-attack
tags:
- AttackCycle/Exploitation/NullByteAttacksPoison null byte attack
Some languages use null bytes (0x00) to know when a string terminates, rather than tracking the actual string length. If a null byte (generally? always? encoded as %00) is included in a string, then everything after that byte is dropped by the interpreter.
Because % characters are themselves special, null bytes need to be encoded in URLs as %2500.
Typically a null byte will either be inserted at the end of a string (to prevent a suffix from being appended or bypass simple path filters) or before a "fake" file extensions (which can cause some file-type checks to pass, again allowing us to download files we'd otherwise be denied access to).
PHP
String parsing for PHP < 5.3.4 is susceptible to the poison null byte. The best way to defend against these attacks is to simply sanitize strings by explicitly removing any null bytes they contain.permalink: spells/poison-null-byte-in-php
tags:
- AttackCycle/Exploitation/NullByteAttacks
- Language/PHPPoison null byte in PHP
$sanitized_string = str_replace(chr(0), '', $original_string);