Bypassing LFI Filters: Null-Byte and Path Truncation

Hello and welcome back!

In the previous lesson, we established a solid foundation for Local File Inclusion (LFI), learning how to identify the vulnerability and bypass several common filters like non-recursive stripping and basic encoding. We briefly touched upon null-byte injection as a way to handle filters that append file extensions.

Today, we will dive deeper into two powerful techniques specifically designed to defeat extension-appending defenses: null-byte injection and path truncation. Mastering these will significantly enhance your ability to exploit LFI vulnerabilities, especially on older or misconfigured systems which you'll frequently encounter in real-world engagements. This lesson will help you understand the low-level mechanics that make these bypasses possible, connecting directly to your computer science background.

1. Deeper Dive: Null-Byte Injection

As we saw previously, a common defense against LFI is to append a required extension to the user-provided filename. For instance, code like include('pages/' . $_GET['page'] . '.php'); ensures that only .php files are included.

The null byte (%00 when URL-encoded) is a control character that signifies the end of a string in C-based languages, which includes many of the underlying functions used by web languages like PHP. By injecting a null byte, you can trick the application into ignoring anything that comes after it, including the appended file extension.

Let's break down how and why this works.

Now that you've seen the theory, let's watch it in action. A practical demonstration is the best way to solidify your understanding.

Key Limitation: It's critical to know that null-byte injection is a classic technique that was patched in PHP version 5.3.4. It no longer works on modern, patched PHP applications. However, you will still find unpatched, legacy systems in corporate environments and bug bounty programs, making this a vital skill to have in your arsenal. The "HackTricks" page on File Inclusion also lists this as a primary bypass technique.

2. The Path Truncation Attack

What do you do when the application is running a modern version of PHP where null-byte injection doesn't work, but it still appends an extension? This is where a more clever and complex technique comes into play: path truncation.

The core idea is to create a filename so long that the server truncates it, cutting off the appended extension. This attack relies on two specific behaviors of the server environment:

1. Filename Length Limit: On many systems (especially Linux), file paths are silently truncated if they exceed a certain length (often 4096 bytes). The extra characters, including the appended extension, are simply discarded.
2. Path Normalization: File systems often treat paths like /etc/passwd/././. as equivalent to /etc/passwd. Trailing slashes or dot-slash sequences are effectively ignored.

By combining these two behaviors, you can craft a payload that bypasses the extension filter.

To summarize the attack from the reading:

• Vulnerable Code: include("includes/".$_GET['param'].".php");
• Goal: Read /etc/passwd.
• Problem: A simple payload like ../../etc/passwd results in the server looking for the non-existent file /etc/passwd.php.
• Path Truncation Payload: ../../etc/passwd/./././././././<...repeat hundreds of times...>
• How it works:
  1. The application constructs the full path: includes/../../etc/passwd/././././.../.php
  2. This string exceeds the 4096-byte limit. The kernel truncates it, dropping the .php at the end.
  3. The resulting path is something like: includes/../../etc/passwd/././././.../
  4. The file system normalizes this path, ignoring the trailing ./ sequences, and ultimately accesses includes/../../etc/passwd, which resolves to /etc/passwd.

This is an elegant bypass that leverages a deep understanding of how different system layers (web application, language runtime, operating system) interact.

Conclusion

In this lesson, you've added two crucial LFI filter bypass techniques to your toolkit. While they both target the same defense mechanism—appended file extensions—they operate on completely different principles.

Key Takeaways:

• Null-Byte Injection (%00) is a string termination attack that tricks the application into ignoring appended data. It is powerful but generally only works on legacy systems (e.g., PHP < 5.3.4).
• Path Truncation is a more complex attack that leverages OS file path length limits to discard an appended extension. It works by creating an excessively long path string filled with components like ./ that are later normalized by the file system.
• Understanding the underlying system mechanics (string handling, file system behavior) is essential for discovering and executing these advanced bypasses.

Next Lesson Preview:
So far, we have focused on including files that are already on the server (Local File Inclusion). What happens if a vulnerable application allows you to include a file from anywhere on the internet? In our next lesson, we will explore Remote File Inclusion (RFI). This is often a more critical vulnerability, as it can allow you to execute your own malicious code on the server, leading directly to Remote Code Execution (RCE).