PHP path truncation¶

root-me challenge: PHP - Path Truncation: Retrieve access to the administration’s zone.

Using EXPLOITING PHP PATH TRUNCATION (PHP < 5.3) and Lettercount.

Techniques¶

• Authentication vulnerabilities

• Directory traversal

• Authentication and session testing runbook

Counter moves¶

PHP path truncation is the case here. Server-side validation and least privilege are what these reduce to. The defensive counterpart is in the blue notes on the application layer as a target.