I have perhaps a fairly straightforward question about the tool dotdotpwn.

Firstly, it seems like an awesome tool for generating the beginning of a directory traversal string, and the fact that it detects the OS and tailors itself accordingly is great - the trouble I am having is trying to figure out what text string I should use if the server is a Windows server?

I get that "root" is a good string for Linux as it tests for /etc/passwd, but I am struggling to find a good string for windows. I tried a few different ones, and it seems to struggle with characters such as [ and ] that I seem to find in examples of a boot.ini file. Can I just use "boot" as the first line seems to be [boot loader]?

I'm not sure if I am missing something fundamental here, Cheers!


It depends on the file you're trying to match. By default dotdotpwn does not require string matching (-k). It is required if you specify a specific file to look for or you are experiencing false positives. As a general rule I tend to look for c:\windows\win.ini as this file is present on all versions of windows unlike c:\boot.ini. By examining a known good win.ini file you can look for a keyword you like, otherwise -k 'mci extensions' should do the trick.

You didn't give an example of the commands you wrote so I'll just guess that you didn't correctly quote or escape the [, ] or space characters. Dotdotpwn will match on the word boot, without the brackets, but a more accurate match reduces the likelihood of false positives.


I would recommend sharing link, usually its good to check default paths which the tool already does but sometimes you might have to add double chars in windows like \.... to navigate directory. Best to download windows directory traversal list and fuzz using that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.