Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [directory-traversal]

The tag has no usage guidance.

1
vote
0answers
34 views

Is there a way to exploit file_get_contents that has a prepended website?

suppose I have the following code that will display an image. The name of the image is supplied by the user as follows: https://example.com/image.php?image=cat.jpg My image.php file contains $...
0
votes
1answer
26 views

Preventing path traversal knowing only the input

I am tasked with preventing a path traversal attack over HTTP by intercepting and inspecting the (unencrypted) transported data without direct access to the target server. From some research it ...
4
votes
2answers
336 views

Directory transversal in PHP with the $_FILES array?

I'm working on a php application that is handling file upload. I'm trying to inject a path transversal payload in the filename such as /../../../../etc/. The thing is that the vulnerable line of code ...
1
vote
1answer
86 views

Mitigate possible file traversal

I am about to start using https://find-sec-bugs.github.io. It is reporting an error of: Bug type PATH_TRAVERSAL_IN for the following code: def writeLocalFile(fileName: String, content: String): Unit ...
0
votes
1answer
142 views

Running Directory Traversal Against POST Request Headers [closed]

I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
1
vote
0answers
227 views

Sending a POST request with directory traversal attack

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
1
vote
1answer
52 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
0
votes
1answer
953 views

Fuzzing a webserver using DirBuster

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
2
votes
0answers
237 views

Prevent Firefox or Chrome from evaluating URLs before page request?

If you browse to this page: http://192.168.10.8/../../../../../windows/win.ini Firefox/Chrome will evaluate the URL first. The resulting page requested will be: http://192.168.10.8/windows/win.ini ...
2
votes
1answer
344 views

Path traversal using hash extension attack

I'm trying to write a PoC for path traversal using hash extension attack on a PHP site. My obstacle is in specifying an acceptable string. The vulnerability is in in the URL: http://127.0.0.1/...
0
votes
1answer
89 views

Constructing file path from database table leading to vulnerability CWE 73: Directory Traversal

I have a table where the machine name, directory path and filenames are stored; when requested, I am supposed to return the content of the file by concatenating the machine_name + '\' + directory_path ...
1
vote
0answers
84 views

Conditions under which PHP path-traversal with %2e works

While trying to replicate a security vulnerability on my local machine I realized that PHP on my machine does not decode %2e as a dot. I created the following test-file: <?php var_dump(file_exists(...
0
votes
1answer
569 views

Stop traversal directory attack with .htaccess?

Is it possible to configure .htaccess to block PHP requests to access items above the root folder? say a malicious script is dropped in to a folder, and it may request access to "../../../../...
5
votes
1answer
279 views

Why is Google using Local File Inclusion and Directory Traversal attempts on my site

If have a firewall on my wordpress site and it has blocked Google from attempting both Local File Inclusion and Directory Traversal attempts. Why would Google be doing this? United States Mountain ...
0
votes
2answers
2k views

Directory traversal in a URL?

Scenario: I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/ However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
1
vote
2answers
437 views

Is this considered directory traversal?

So I'm currently testing a site that has a url like this example.com/dir1/dir2?nextPage=/someOtherDir/someHTMLfile.html I found that I can do to get to the home page example.com/dir1/dir2?nextPage=....
4
votes
1answer
1k views

Function of %5c.. in a path traversal

I've recently come across this blog post of a bug bounty hunter. Apparently, a path traversal vulnerability was discovered, which looked like this: http://help.example.com/@app/skin/views/%5c../%5c....
3
votes
1answer
276 views

Is it safe to rm -rf an untrusted directory?

There are a lot of linking tools(symlinks, hard links, mount, etc.) available. Suppose a disgruntled employee gets the idea that he's going to hide a link to the root directory or some mission-...
-3
votes
1answer
615 views

Directory Traversal or File System Permissions? [closed]

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and last one is a binary- file is ...
1
vote
3answers
496 views

PHP file upload: Order of security measures

In a PHP file upload form, the name and extension of the file should be changed in order to prevent directory traversal attacks. I don't fully understand these attacks, therefore I'm uncertain if some ...
2
votes
1answer
400 views

Getting remote access via path traversal for Java webapps

I've found path traversal for a web application and I can get the contents of all files the webserver user have read access to. I want to further exploit this. With PHP websites I'm sometimes able to ...
1
vote
1answer
921 views

Bypassing Directory Traversal Filter with separate Folder and File Inputs

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes. What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt,...
2
votes
2answers
427 views

Dotdotpwn - Different text patterns

I have perhaps a fairly straightforward question about the tool dotdotpwn. Firstly, it seems like an awesome tool for generating the beginning of a directory traversal string, and the fact that it ...
3
votes
1answer
253 views

Any security vulnerability using filenames generated from database?

Ok, for example, say you have settings stored in a database where the user selects the language of the site. For example, say the language they chose was English and now has a setting of en. Then ...
39
votes
3answers
5k views

Unable to understand why the web app is vulnerable to a Directory traversal attack

I was working with this web-app, when someone pen-tested it and sent me a huge report that says my app is vulnerable to a Directory traversal attack. Here is one sample: Testing Path: http://127.0.0....
12
votes
2answers
5k views

How to prevent directory traversal when joining paths in node.js?

I have a node.js webapp in which I need to concatenate two paths in a safe way. The first one (leftmost) is a constant, and the second one (rightmost) is relative to the first one and comes from ...
6
votes
3answers
4k views

Bypass directory traversal filter in PHP?

I have a legacy PHP app, which has code similar to this: <?php $doc = $_GET['doc']; if (preg_match('#\.\./#', $doc)) { header("HTTP/1.1 403 Forbidden"); die(); } $content = ...
0
votes
1answer
40 views

What bytes are stripped by info-zip?

I see many software that check only for..between path separators. For a long time I thought they were no possibility to exploit invalid bytes (for example attempt to create.‌.will lead to.?.on osx). ...
9
votes
2answers
360 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
0
votes
1answer
236 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
1
vote
2answers
43 views

Protect Public Directories Linux

Just for a brief overview. I have a system that can generate invoices and has a login system for a user to generate his/her invoices. Lets say the platform resides at /platform and the invoices in /...
-2
votes
1answer
435 views

directory traversal encoding CAPEC \x4F [closed]

I want to ask about something called CAPEC \x4F, I know it has something to do with directory traversal characters' encoding, but I dont know anything else about it
0
votes
2answers
197 views

Do you need to know the filename to conduct a Directory traversal

If my websites has a directory traversal vulnerability (linux) and my other php pages have complicated filenames (e.g. efj93ehdsijgdij3g.php), could an attacker still access other files? Or an ...
6
votes
2answers
351 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
8
votes
1answer
1k views

Directory traversal sample code

I'm studying 'Directory traversal' attack in Android applications using this link I understand the concept behind the vulnerability that the input needs to be sanitized properly before opening any ...
2
votes
1answer
643 views

How to exploit this piece of code? (format string in printf?) [closed]

So this piece of code is vulnerable to format string vuln (I think) in the printf() function. It reads a file in /tmp/file so I've tried writing different modifier/strings in that file and see what ...
50
votes
6answers
25k views

What can hackers do with ability to read /etc/passwd?

On the exploit websites I see security analysts and hackers targeting the /etc/passwd file when showing the proof of concept. If you have a local file inclusion or path traversal vulnerability on ...
1
vote
2answers
4k views

Execute cmd commands with http directory traversal attack

Question Summary: I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
1
vote
1answer
1k views

What makes an Android application vulnerable to Directory Traversal?

Definition of Directory Traversal Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root ...
3
votes
2answers
3k views

Is enough to remove “..” from strings to avoid directory traversal attack?

Lets say I want to build a simple PHP script that let me access files inside a folder: $path = $_GET['path']; $path = str_replace('..', '', $path); $path = "./static/" . $path; readfile($path); Is ...
1
vote
0answers
203 views

Is it dangerous to append search query to the base URL?

I'm testing drupal website and I've noticed that search query gets appended to the base URL in the response, like so: query: "hey ho: there" http://www.baseurl.com/search/node/hey ho%3A there query: ...
1
vote
2answers
11k views

Path traversal exploit

I have an Apache server which seems to be vulnerable to path traversal, because when I test this URL: http://localhost/ati/../test.txt it will be changed to the this: http://localhost/test.txt and ...
8
votes
2answers
2k views

How to list all files with only arbitrary file path read, but no directory listing nor sudo?

I have found a path traversal vulnerability that allows me to read any path on the server that does not require sudo. To fully exploit this, I would like to know which files exist in each directory ...
-2
votes
1answer
5k views

Alternative ways to exploit this path traversal

I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files: A....
-2
votes
2answers
6k views

Finding Directory traversal vulnerability [closed]

I want to test a web application for Directory Traversal (DT) vulnerability. I have gone through a lot of google pages but can't find a clear description. I've tried using ../.././../../etc/passwd ...
2
votes
2answers
5k views

How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the ...
1
vote
2answers
2k views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
0
votes
4answers
3k views

Hacking Windows Box via Directory Traversal

I am practicing directory traversal attacks and found a vulnerability in a windows XP machine that is running a vulnerable HTTP server that is prone to directory traversal. I can guess file names and ...
8
votes
3answers
7k views

Difference between directory traversal and file inclusion

I guess the title says it all. There seems to be no obvious difference between directory traversal and file inclusion vulnerabilities. But I guess there must be some difference, since the www....
7
votes
2answers
2k views

How do you exploit Directory Traversal to traverse from one drive/share to another?

I'm trying to figure out if it is possible to traverse across drives or shares. If I have a path that is concatenated in a web application, where the prefix is a drive, such as this: var path = "D:\"...