I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.
What I have to do is access a file named passwords.txt
located in \files\private\admin\passwords.txt
, I am on \files\public\
and the URL parameters are the following:
/download.php?folder=&file=&action=download
The path is built concatenating the values of the parameters folder
and file
to the path \files\public\
. None of them are vulnerable to SQL Injection according to SQLMap, neither action
. So, if I put:
/download.php?folder=private\admin\&file=passwords.txt&action=download
The resulting path will be \files\public\private\admin\passwords.txt
I have tried the simplest trick like putting \..\
(in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ..
.
So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\
if I want access to that file (DBMS is MySQL).
It is possible to delete the \public\
part of the path using comments with #
or another way so I can finally get access to the private
directory?
?folder=z;select filename from all_files where filename = '\private\admin\passwords.txt';&action=download
..\private
? That's the simplest path transversal. But, if you are after manual vulnerability discovery then you should read code. If you do not have the code then you should go for fuzzying.