How Null Byte Injections Work: A History of Our Namesake « Null Byte :: WonderHowTo

In thisNull Byte, I'm going to teach you about Null Byte Injections.Null Bytes are an older exploit. It works by injecting a "Null Character" into a URL to alter string termination and get information or undesirable output (which is desirable for the malicious user).All languages of the web are exploitable with this if your code isn't sanitizing input -OR- parsing files properly. Null bytes are put in place to terminate strings or be a place holder in code, and injecting these into URLs can cause web applications to not know when to terminate strings and manipulate the applications for purposes such as LFI/RFI (Local and Remote File Inclusion).A null byte in the URL is represented by '%00' Which in ASCII is a "" (blank space).I'll be showing you how to use this exploit on some vulnerable php code.How to Exploit by ExampleWhen running a webpage, the designer may have coded a bit of PHP to fetch images from the server. So let's assume they used this simple snippet of PHP below to load the image called from X webpage.Here is the PHP code example that we will exploit:$file = $_GET['file'];require_once("/var/www/images/$file.jpg");This is what the URL extension would normally look like:.php?file=file.jpgThis is calling "file.jpg" from the server and displaying it to the webpage. We would exploit it like so by adding the Null Byte to the end of a local/remote file call:.php?file=[file inclusion here]%00Example:.php?file=../../../../../../etc/passwd%00Why Does This Happen?The PHP code above is vulnerable because it's parsing files from the database, and just appending the ".jpg" extension to the end to make them display as picture files.By injecting a null byte, the extension rule won't be enforced because everything after the null byte will be ignored. You can use this PHP code to fix it, removing NULL characters from a string.Example PHP code:$file = str_replace(chr(0), '', $string);This attack is mostly deprecated in PHP6, but you might be surprised how many people are still using PHP5.This attack is also useful on other languages, such as the Perl scripting language.Here's the Perl counter-part to the example above:$buffer = $ENV{'QUERY_STRING'};$buffer =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;$fn = '/home/userx/data/' .$buffer. '.jpg';open (FILE,"<$fn");Here's how it would be exploited:read.pl?page=../../../../etc/passwd%00jpgAs you can see, the exploit is pretty uniform in the way it's carried out. I hope this gives you the insight you need on Null Byte Injections.Discuss or ask questions in theforums!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Hack WPA WiFi Passwords by Cracking the WPS PINSQL Injection 101:How to Avoid Detection & Bypass DefensesSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow To:Use SQL Injection to Run OS Commands & Get a ShellHow To:Hack Your Kindle Touch to Get It Ready for Homebrew Apps & MoreSQL Injection 101:Advanced Techniques for Maximum ExploitationWeekend Homework:How to Become a Null Byte Contributor (2/24/2012)Weekend Homework:How to Become a Null Byte Contributor (3/2/2012)A Null Byte Call to Arms:Join the Fight Against IgnoranceFarewell Byte:Goodbye Alex, Welcome AllenHow To:Spider Web Pages with Nmap for SQLi VulnerabilitiesGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsNews:Get YouTube's New Layout Today with a Simple JavaScript HackNull Byte:Never Let Us DieNews:Null CommunityHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitWeekend Homework:How to Become a Null Byte Contributor (2/3/2012)Weekend Homework:How to Become a Null Byte Contributor (2/17/2012)News:A History of Aglorithms, Cryptography and How They Relate to Online Security.How To:Things to Do on WonderHowTo (03/21 - 03/27)How To:Get Free Netflix for LifeSkyrim Hack:Get Whatever Items You Want By Hacking Your Game SaveGoodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingHow To:Run a Virtual Computer Within Your Host OS with VirtualBoxHow To:Things to Do on WonderHowTo (02/08 - 02/14)How To:Enable Code Syntax Highlighting for Python in the Nano Text EditorWeekend Homework:How to Become a Null Byte Contributor (2/10/2012)Community Roundup:Fix an Xbox with Pennies, Carve Polyhedral Pumpkins & MoreCommunity Byte:Coding an IRC Bot in Python (For Beginners)How To:Get Packet Injection Capable Drivers in LinuxNews:Packet Capture + Cloud Technology == AwesomeHow To:Things to Do on WonderHowTo (11/9 - 11/15)News:WebChat for Null Byte IRC!How To:Things to Do on WonderHowTo (01/18 - 01/24)Weekend Homework:How to Become a Null Byte Contributor (3/16/2012)How To:Things to Do on WonderHowTo (02/29 - 03/06)How To:Safely Log In to Your SSH Account Without a PasswordNews:A Last Resort Method to Fix the Xbox 360 E74 Error (The Red Ring of Death)Goodnight Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingHow To:Customize Your Linux Desktop