I've found path traversal for a web application and I can get the contents of all files the webserver user have read access to. I want to further exploit this.
With PHP websites I'm sometimes able to get remote access the following way:
- I get reponse HTML pages with parts of it being the contents of the requested file
- I manipulate my requests so that executable PHP code gets written to the webserver logfiles.
- I try to GET logfile contents thus executing my PHP code.
This is only possible if the remote file contents are shown via include
or require
or stupidly eval
'd. In most cases it's something like file_get_contents
and echo
, which does not execute the code. But there were cases where I succeeded doing so, and I got myself a little shell that uses system
to execute anything passed as a GET parameter with the privileges of the webserver user.
My question is, is there a similar vulnerability for webapps written in Java? Is it common? How do I exploit it?