0

I'm pentesting my new website, and used weevely to generate a php payload. I manually put it in the images directly where users will be able to upload images to my website. I'm able to establish a reverse connection to the weevely payload in /images. Is it possible to tell nginx and/or php not to interpret commands coming from the /images directory? Other than properly[1] coding a secure input mechanism with file validations, is there anything else we can do to prevent payloads from being executed in specific (/images) directories?

[1] https://php.earth/doc/security/uploading

user www-data;
worker_processes  auto;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;
    charset utf-8;
    server_tokens  off;

    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Frame-Options DENY;
    add_header Referrer-Policy "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Pragma public;
    add_header Cache-Control "public";

    include /etc/nginx/conf.d/*.conf;

    gzip on;
    gzip_comp_level 2;
    gzip_min_length 1000;

    server {
    listen 127.0.0.1:80;
    server_name website.com;
    root /var/www/website/;
    index index.php index.html;

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_param HTTP_PROXY "";
        fastcgi_pass 127.0.0.1:9000;
        include fastcgi_params;
    }

    location ~* .(png|ico|gif|jpg|jpeg|css|html|txt|php)$ {
        expires 2d;
            add_header Pragma public;
        add_header Cache-Control "public";
    }

    if ($request_method !~ ^(GET|POST)$) {
         return 444;
    }
    }
}

1 Answer 1

0

Question is unclear. What do you mean by "interpret commands". Nginx serves files and proxies requests to other servers or services, such as PHP. PHP runs scripts.

I think you want the images directory to just serve files, not run PHP scripts.

I've added my caching headers. Pragma is old, you don't need to use it.

location \images
   root \whatever;
   add_header Cache-Control "public, max-age=691200, s-maxage=691200";
   more_clear_headers Server; more_clear_headers "Pragma"; more_clear_headers "Expires";
}

Alternately you can use something like the answer to this question:

location ~ /images/(.+)\.php$ {
  deny all;
}
location ~ \.php$ {
  // as above
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .