Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
3 edited body
source | link

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

IsIt is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

Is is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

It is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

2 deleted 9 characters in body; edited title
source | link

It is possible to modify a path directory through the URL parameters? Bypassing Directory Traversal Filter with separate Folder and File Inputs

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is to access to a file named passwords.txt located in \files\private\admin\passwords.txt when I, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access to the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want to access to that file (DBMS is MySQL).

ItIs is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

It is possible to modify a path directory through the URL parameters?

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is to access to a file named passwords.txt located in \files\private\admin\passwords.txt when I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access to the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want to access to that file (DBMS is MySQL).

It is possible to delete the \public\ part of the path using comments with # or another way so I can finally access to the private directory?

Bypassing Directory Traversal Filter with separate Folder and File Inputs

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt, I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

Is is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

1
source | link

It is possible to modify a path directory through the URL parameters?

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is to access to a file named passwords.txt located in \files\private\admin\passwords.txt when I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access to the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want to access to that file (DBMS is MySQL).

It is possible to delete the \public\ part of the path using comments with # or another way so I can finally access to the private directory?