I've found path traversal for a web application and I can get the contents of all files the webserver user have read access to. I want to further exploit this.
With PHP websites I'm sometimes able to get remote access the following way:
- I get reponse HTML pages with parts of it being the contents of the requested file
- I manipulate my requests so that executable PHP code gets written to the webserver logfiles.
- I try to GET logfile contents thus executing my PHP code.
This is only possible if the remote file contents are shown via
require or stupidly
eval'd. In most cases it's something like
echo, which does not execute the code. But there were cases where I succeeded doing so, and I got myself a little shell that uses
system to execute anything passed as a GET parameter with the privileges of the webserver user.
My question is, is there a similar vulnerability for webapps written in Java? Is it common? How do I exploit it?