I have a Linux-based embedded system with web-interface for management purposes. According to one security paper, this web-server has rudimentary filter against directory traversal attacks in URL parameters. So in order to bypass the "../" filter, an URL with special strings needs to be used. What are the common path traversal filter bypass techniques?
There are various encodings you can try to enable you to bypass a filter:
\at the start of the folder name to try and reach the root directory.
%5c(percent encoded versions of the above).
- Try using 16-bit Unicode encoding (
- Try double URL encoding (
- Try overlong UTF-8 Unicode encoding (
If you get a different response trying one of the above then you have managed to change either the execution path or the file system path that is being accessed. This may indicate that the particular sequence used may be worthy of additional investigation.
The general concept is to use characters that can fool the path traversal code. Things like embedded nulls, unicode notation, and such can sometimes bypass the path traversal filter.
Note that a strong implementation will not be susceptible to any of these. It will use a character white-list and other measures that will prevent any of these tricks from succeeding.