Top 10 winner
PHP filter chains: file read from error-based oracle
PHP filter chains are stacked so an iconv conversion inflates a file until the memory limit aborts the request, while a dechunk filter drops the data when the leading byte is a hex digit. Whether the error fires is a one-bit oracle on that byte, and further encodings rotate each remaining byte into first place, reading a whole local file through functions that never print it.
Record
- Researcher
- Rémi Matasse
- Published by
- Synacktiv
- Topic
- Server
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Rémi Matasse, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .