5

I asked a question on this very site - Unable to understand why the web app is vulnerable to a Directory traversal attack , where i was given a report stating my web-app was vulnerable.
I posted few samples from the report, like Testing Path: http://127.0.0.1:80/??/etc/issue <- VULNERABLE!, now i was asked what those two /?? are in the posted url.

I ran few tests:
http://127.0.0.1:80/??/etc/issue returns Home page.
http://127.0.0.1:80/.?/etc/issue returns Home page.
http://127.0.0.1:80/?./etc/issue returns Home page.

So, the pattern below returns home page:
http://127.0.0.1:80/Position1Position2Anything/Anythingcouldbehere , where
If Position1 = ? , home page is returned irrespective of the contents at Position2.

If Position1 = . then Position2 must be ?, for the home page.
Anything could be an empty string too.

Now, anything which doesn't match the pattern above returns 400/404.
And, i ran the above test for security.stackexchange.com/ and it too returned the same result (followed the same pattern of . and ? ) and returned its Home page on the browser.

Please explain the role of ? and . in the urls.

EDIT:
It's only this pattern(the one above, with ? and .) which makes the web-app Vulnerable to Directory Traversal attack as per the report sent by pen-testers.

  • 1
    I totally missed seeing that /.? is getting converted into /? , and /? being a legal query string is returning the home-page. I guess, i have the answer now. I have no idea as to how could i close a question, so if someone can do it - please close/delete this question. – Batman Sep 8 '16 at 14:01
  • When visiting this page you should have a delete button just under the question text before the comments. Just click that. – Jonah Benton Sep 8 '16 at 14:29
  • 3
    I don't think you should delete the question, just because you found the answer yourself. Two upvotes show that two users found the question interesting. You should answer your own question and add details/links about Browsers handling path traversals ./.. and the query string, because in the future other users may have the same problem and your answer will help them! – Falco Sep 8 '16 at 15:40
  • 2
  • 1
    @CodesInChaos This question is a follow up question to Batman's previous question. – cpburnz Sep 8 '16 at 18:28
3

In HTTP URL's everything after the symbol ? is a part of GET request data.

  • So In http://127.0.0.1:80/??/etc/issue and http://127.0.0.1:80/.?/etc/issue the part ?/etc/issue is essentially a data in GET request to URL http://127.0.0.1:80/.

Note here that ?/etc/issue is not a valid file path.

  • In http://127.0.0.1:80/?./etc/issue the part ./etc/issue is essentially the data in GET request to URL http://127.0.0.1:80/.

Note Here that ./etc/issue is a valid path. (may be ./etc/passwd is better)

In last case,since the scanner got a (HTTP/1.1 200) it assumed that it has read the file on server and marked it as vulnerable.

The scanner is expecting something like a HTTP/1.1 404 (Not Found) or HTTP/1.1 302 ( URL redirection) for that page to be not vulnerable.

  • 2
    it's actually safer to serve up the home page for non-existing and blocked urls than reveal the structure. – dandavis Sep 8 '16 at 19:14
  • 1
    Nice, that helped. – Batman Sep 10 '16 at 14:47
  • 2
    This is a false positive finding from dotdotpwn, the ? Should be URL encoded, but there isn't a neat way to do that currently and I haven't taken the time to introduce a way to solve it. The current work around is to use the command line switches to specify a known file and keyword to match from that file. This way it will only trigger if the actual file content is returned by the url. In my experience pentesters will manually validate findings and proceed to pillage files if a traversal flaw is found. – wireghoul Sep 11 '16 at 12:22
  • @wireghoul:Thanks for the detailed response. Just asking, couldn't we just introduce an identifier in our web-app (while testing), say in the <body> so that we could easily & quickly strike-out those vulnerable lines which contain the identifier while leaving other real vulnerable lines in the report. Basing this comment on the fact that ? usually returns pages from the web-app only. – Batman Sep 14 '16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.