Scenario:
I have a webserver running nginx. I have my html files in /var/www/
and pictures in /var/www/pictures/
However, I also have some secret pictures in /var/www/pictures/secretpics/
which I must keep hidden.
So I updated my nginx conf with:
location /pictures/secrectpics/ {
deny all;
return 404;
}
So I tested this in my browser. I typed in www.myexamplesite.com/pictures/secretpics/secret01.png
and received 404. (assuming that secret01.png is a real picture.)
Questions: 1. Is there a way to circumvent this and actually get access to secret01.png?
For example, is something like the following possible?
www.myexamplesite.com/pictures/../pictures/secretpics/secret01.png
- If the above is possible, how should I secure my
secretpics
?
telnet
as most browsers or other utilities (e.g.wget
) will pre-filter the../
(as you can see for yourself by checking your logs when testing). Also, the general name for the attack you're asking about isdirectory traversal
. – user15392 Aug 24 '17 at 5:43