1

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the server will return a 403 error. Is there a way to send this POST request with dotdotpwn and then begin to run the directory traversal fuzzing attack? Maybe dotdotslash might work better?

For example:

POST /api/edge/feature.json HTTP/1.1
Host: 192.168.2.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Referer: https://192.168.2.1/
Content-Type: application/json
X-CSRF-TOKEN: 4310724fdcab5474ab225a105bd6f86d43247dbaf5b7f4aa2ec329a641ec55ec
X-Requested-With: XMLHttpRequest
Content-Length: 90
Cookie: ip_address_top_user_option=total_bytes; PHPSESSID=i6um09hej0ku2k5ctcp6ib56f1nrqhi7; X-CSRF-TOKEN=4310724fdcab5474ab225a105bd6f86d43247dbaf5b7f4aa2ec329a641ec55ec
Connection: close

{"data":{"scenario":"../../../../../home/operator/Backdoor","action":"load"}}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.