This collection of links tests various features of server-side includes, including environment variable passing to server-side executed programs, and security access.
Example 1 contains server-side include references. If your server is configured to only parse documents with suffices
.shtml
, then there should be no SSI data in the returned document.
The document parse1.shtml is a parsed HTML document that tests
echo var=
,flastmod file=
,flastmod virtual=
,fsize file=
,fsize virtual=
,errmsg, timefmt, sizefmt
, and simpleexec cmd=
bourne shell execs. File includes and CGI exec includes are tested in other files.
- parse1.shtml/ext%20ra/path?query%25;/?:@=&$-_.+!*'(),"
If the query string and extra path information are not properly processed, you can use the next three tests to narrow down the source of the problem- parse1.shtml
- parse1.shtml/ext%20ra/path
- parse1.shtml?query%25;/?:@=&$-_.+!*'(),"
- lnk_parse1.shtml (reference is a link to the simple, parsed file -- linked resource is in an execute allowed directory)
- lnk2_parse1.shtml (reference is a link to the simple, parsed file -- linked resource is in another directory -- you should modify access privilages to this directory to test control over link execs).
- nasty_link.html (reference is a link to a text file in /etc -- you don't want this to be possible!)
- nasty_link.shtml (reference is a link to a text file in /etc -- you don't want this to be possible!)
This example tests server-side includes, and CGI executes from within parsed HTML documents. In this test, the documentinc_file.shtml
is included inparse2.shtml
.In addition, the documentinc_file.shtml
includes the program output from/cgi-bin/test_script.cgi
.
- parse2.shtml/ext%20ra/path?query%25;/?:@=&$-_.+!*'(),"
If the query string and extra path information are not properly processed, you can use the next three tests to narrow down the source of the problem- parse2.shtml
- parse2.shtml/ext%20ra/path
- parse2.shtml?query%25;/?:@=&$-_.+!*'(),"
- Source listings: parse2.shtml | inc_file.shtml | test_script.cgi
The programrecurs_test.shtml
test for infinite recursion of server-side includes.
- recurs_test.shtml
- Source listings: recurs_test.shtml | recurs.shtml | recurs2.shtml
The document main2.html provides a test suite that tests CGI program execution. The interest here is only on security constraints, and on restricting where CGI programs are allowed to execute.