0

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is readable by www-data(apache2) user (e.g. the file with permission of rw-r--r--). This limits the usage of this hole since I can get /etc/passwd while I cannot download /etc/shadow. So My question is that what else valuable file can be downloaded under this restriction?

closed as primarily opinion-based by Steffen Ullrich, Tobi Nary, Neil Smithline, Matthew, M'vy Apr 25 '16 at 9:13

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    The answer would depend on what one considers valuable and depending on the server setup, so it is both too broad and opinion based. But for example this could be access to a database with credit card information etc. – Steffen Ullrich Apr 24 '16 at 13:56
  • 1
    Source code is good. Also /proc/self/environ – paj28 Apr 24 '16 at 14:33
  • "most valuable file" will depend on what's stored on the server ... – schroeder Apr 24 '16 at 20:16
1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db.

Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, etc.

  • yes, I tried to find the source code, but the problem is that I don't know the name or the path of source code file (They are not in the default /var/www directory). Then I tried to download nginx or apache configure file, but failed to get those too. – n3v3rm03 Apr 28 '16 at 15:58
  • you can get all the source code of the web app starting from a file you know lets say index.php. There is no need to know the full path, once you get one file then by checking the code inside you go and find the rest, for example you find require_once('config.php'); on index.php then you know config.php is on the same directory as index, so you'll just download config from there and so on. – skenderbeu Apr 28 '16 at 21:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.