Stupid question

[singur]

Is it possible to inject a null-byte/encoded hex caracter into a request filename?
Based on my tests...it seems to be impossible...but i read in some places that this is possible.
Source used for tests:

Code: Select all

<form method="POST" enctype="multipart/form-data">
    <input type="file" name="f1" />
    <input type="submit" value="send" />
</form>
<?php
echo rawurlencode($_FILES['f1']['name']);
?>


Tried to do it in many different ways...
Thanks in advance...
And...could someone please get me a real bruteforce algorithm?

Ps: brazilian dude over here...sorry for my ridiculous english.

[thedotmaster]

Maybe you mean something like this:

Code: Select all

<?php
include($_GET['file']+'.txt');
?>


If you wanted to open .htaccess for example, script.php?file=.htaccess would try to open .htaccess.txt
A null byte is added on the end of the filename and php detects this as the end of the string.

Is that what you meant?