5

I am performing a penetration testing on an application hosted on an Ubuntu environment.

So using a path traversal vulnerability, I can download any file.

The API web application runs as root (shadow and brute-force are already my friends). Funny situation: I can not find the web root folder.

What I have tried:

What else should I try?

  • What about the /opt location? – Jeroen Mar 15 at 23:58
  • @Jeroen-ITNerdbox no luck :) – Lucian Nitescu Mar 16 at 0:09
7

Use the traversal vulnerability to read

/proc/self/environ

This prints out environment variables among other thread information.

Look for a environment variable called DOCUMENT_ROOT

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.