-2

I want to test a web application for Directory Traversal (DT) vulnerability.

I have gone through a lot of google pages but can't find a clear description. I've tried using ../.././../../etc/passwd along with the URLS however not sure where I'm heading.

Please help me find any links where I can read and go ahead testing the DT vulnerability.

closed as too broad by TildalWave, Gilles, Xander, Iszi, Steve Sep 29 '14 at 16:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

4
  1. Directory Traversal is an HTTP exploit which allows attackers to access restricted directories and execute commands outside of the web server's root directory.

I'll help you with an example on this.

  1. In web applications with dynamic pages, input is usually received from browsers through GET or POST request methods. Here is an example of a GET HTTP request URL:

https://test.example.com/show.asp?view=oldpage.html

  1. With this URL, the browser requests the dynamic page show.asp from the server and with it also sends the parameter "view" with the value of "oldpage.html". When this request is executed on the web server, show.asp retrieves the file oldpage.html from the server's file system, renders it and then sends it back to the browser which displays it to the user. The attacker would assume that show.asp can retrieve files from the file system and sends this custom URL:

https://test.webarticles.com/show.asp?view=../../../../../Windows/system.ini ==> This will cause the dynamic page to retrieve the file system.ini from the file system and display it to the user.

  1. The expression ../ instructs the system to go one directory up which is commonly used as an operating system directive.
1

A directory traversal vulnerability is a vulnerability easy found through automation, so it's better to just run whichever tool you want to find if a site is vulnerable.

However, if still you want to manual check whether or not a site is vulnerable, you need to identify a point where a file is loaded, i.e. test.php?file=myfile.txt and then guess the physical path on the server.

Assuming a standard installation, let's say /var/www/html/yoursite/test.php, you would need four back jumps (../../../../) to get to the root and then go for etc/passwd.

Not the answer you're looking for? Browse other questions tagged or ask your own question.