I'm pentesting my new website, and used weevely to generate a php payload. I manually put it in the images directly where users will be able to upload images to my website. I'm able to establish a reverse connection to the weevely payload in /images
. Is it possible to tell nginx and/or php not to interpret commands coming from the /images directory? Other than properly[1] coding a secure input mechanism with file validations, is there anything else we can do to prevent payloads from being executed in specific (/images) directories?
[1] https://php.earth/doc/security/uploading
user www-data;
worker_processes auto;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
charset utf-8;
server_tokens off;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options DENY;
add_header Referrer-Policy "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Pragma public;
add_header Cache-Control "public";
include /etc/nginx/conf.d/*.conf;
gzip on;
gzip_comp_level 2;
gzip_min_length 1000;
server {
listen 127.0.0.1:80;
server_name website.com;
root /var/www/website/;
index index.php index.html;
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_param HTTP_PROXY "";
fastcgi_pass 127.0.0.1:9000;
include fastcgi_params;
}
location ~* .(png|ico|gif|jpg|jpeg|css|html|txt|php)$ {
expires 2d;
add_header Pragma public;
add_header Cache-Control "public";
}
if ($request_method !~ ^(GET|POST)$) {
return 444;
}
}
}