I used zap to scan one of my websites and found a path traversal issue.
These are the informations:
Attack: c:/ URL: www.example.com/example.php Parameter: mail
I am now tinkering around in the browser and in CMD with curl and try to get access to the root, but nothing works. Could it be a false positive?
I have done tons of tests now, but shouldn't these give some results:
www.example.com/example.php?mail=../../ www.example.com/example.php?mail=..%u2216..%u2216 www.example.com/example.php?mail=..%c0%af..%c0%af (I tried even more encodings) www.example.com/example.php?mail=c:/
Here is an example with cURL:
curl --path-as-is -X POST --data "mail=..%c0%af..%c0%af" https://www.example.com/example.php
I found where ZAP displays which request has been done:
But the response looks correct. Its the HTML site.
If I execute this cURL I get an empty response, there is nothing.
curl --path-as-is -X POST --data "mail=c%3A%2F" --url "https://www.example.com/example.php"
If I make the same request through the browser and look at response I see:
Failed to load response data
Wow... it was a false positive. So here is what happened. I had an inline html comment, which looked like that:
<!-- enemies, boulders, etc. -->
I noticed that zap has marked (grey color) the word
etc. I assume because its usually part of an important file system path.
I have no clue how this could be connected to path traversal, but after removing the comment zap does not alert this issue anymore.