-2

I want to ask about something called CAPEC \x4F, I know it has something to do with directory traversal characters' encoding, but I dont know anything else about it

closed as off-topic by Xander, Neil Smithline, Steffen Ullrich, TildalWave, Mark Buffalo Mar 12 '16 at 23:47

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – Xander, Neil Smithline, Steffen Ullrich
If this question can be reworded to fit the rules in the help center, please edit the question.

0

CAPEC is the "Common Attack Pattern Enumeration and Classification". \x4F is hexadecimal for 79.

CAPEC-79: Using Slashes in Alternate Encoding is about encoding the slash character to bypass filters that should filter for directory traversal.

  • can you give me an example of slash character encoding please?, because I am trying to try a directory listing vulnerability on a wargame site, but that site has filtered the common methods to do the directory traversal thing – adib Mar 12 '16 at 17:39
  • Also how did you know that \x4F is hexadecimal for 79, I was using an converter from hex to text but it shows me the value O – adib Mar 12 '16 at 17:42
  • 1
    @adib The linked article names a couple of examples, eg using \ instead of /, URL encoding, utf8 encoding, etc. and \x just denotes that the following is hexadecimal (so you don't eg confuse \x11 with 11 (decimal), and 4F (hex) is 79 (dec). – tim Mar 12 '16 at 17:50
  • I have tried it, It doesn't work. It gives me an error saying Invalid url. But when I try %2F..%2F..%2Ftrojan_robot.txt it says permission denied – adib Mar 12 '16 at 18:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.