Questions tagged [path-injection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
149 views

Some random string is appended prefixed by a DOT at the end of URL

Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows. The request URL which our ...
user avatar
  • 111
2 votes
1 answer
517 views

Using this path traversal security issue

I used zap to scan one of my websites and found a path traversal issue. These are the informations: Attack: c:/ URL: www.example.com/example.php Parameter: mail I am now tinkering around in the ...
user avatar
  • 157
2 votes
1 answer
220 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
user avatar
  • 411
2 votes
1 answer
95 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
user avatar
  • 1,670
0 votes
2 answers
617 views

Check for vulnerabilities on website having an error with realpath PHP

I found a website with a download.php file which can get different values in the url parameter (e.g. www.example.com/download.php?url=value). When I give ../../ as a value for the url it throws me the ...
user avatar
  • 103
4 votes
1 answer
2k views

strstr and fopen, is there a bypass?

I have a binary that does this: if (strstr(USERCONTROLLERSTRING, "..")) exit; fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r"); then spits out all the content of the file. Is there any ...
user avatar
  • 193
93 votes
8 answers
17k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
user avatar
  • 911
7 votes
2 answers
2k views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
user avatar
  • 215
1 vote
1 answer
160 views

Unable to replace linux binary

I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo. I copied ...
user avatar
1 vote
2 answers
4k views

Path traversal via filename

Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames? For example, naming a file "...
user avatar
1 vote
3 answers
887 views

Is it dangerous to pass user input to the require function in Node.js?

TL;DR: Is it dangerous to have user input used in a require function in Node.js? Can it be used to read files, and if so how can I protect against that? For example, I have an ExpressJS server ...
user avatar
  • 111
9 votes
2 answers
2k views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
user avatar
  • 1,289
0 votes
1 answer
172 views

Unsafe to not provide full path to powershell script?

Is the following statement in a batch file unsafe? powershell -executionpolicy bypass -File .\test.ps1 test.ps1 is located in the same folder as the batch file. Is it possible to add something in ...
user avatar
-3 votes
2 answers
217 views

Are path traversal attacks possible if attacker is not authenticated? [closed]

Are path traversal attacks possible if attacker is not authenticated in web-application?
user avatar
  • 351
14 votes
2 answers
25k views

Path traversal filter bypass techniques?

I have a Linux-based embedded system with web-interface for management purposes. According to one security paper, this web-server has rudimentary filter against directory traversal attacks in URL ...
user avatar
  • 351
1 vote
2 answers
2k views

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was worried ...
user avatar
  • 317
-2 votes
1 answer
8k views

Alternative ways to exploit this path traversal

I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files: A....
user avatar
1 vote
3 answers
6k views

How to exploit this include_once vulnerability in PHP?

I'm performing a static analysis on a PHP code and came across this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP request: ...
user avatar
  • 113
0 votes
0 answers
143 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix http://domain.com/some/url/$tags.get(%...
user avatar
  • 393
5 votes
2 answers
2k views

Any vulnerabilities in allowing users to choose path of S3 file?

I'm building a web app that uses S3. In some of our operations, we're creating a file on S3 with a path that's directly dependent on user input, so an attacker might cause a file to be created on S3 ...
user avatar
  • 1,988
-2 votes
1 answer
322 views

Commonly used url parameters [duplicate]

I'm working on a project that requires me to tamper with/rewrite url parameters. I'd also like to add in something that finds request parameters such as ?admin=false ?debugging=false ?page=example ...
user avatar
3 votes
1 answer
949 views

How to protect the code of Windows applications against path traversal?

I'm writing a simple HTTP server in Lua and while I can easily find resources on how to secure against Unix directory traversal, I already found some caveats in the Windows version. While I'm already ...
user avatar
  • 6,504
2 votes
3 answers
3k views

sql injection, exec and preg_replace filter

Ive been informed this is not safe to use in regards to sql injection: preg_replace("/[\"'%()@$.!&?_: #\/-]/","", mysql_real_escape_string($_GET['var'])); what would be the difference in the ...
user avatar
3 votes
1 answer
1k views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
user avatar
1 vote
1 answer
222 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
user avatar
  • 13.8k
7 votes
2 answers
3k views

How do you exploit Directory Traversal to traverse from one drive/share to another?

I'm trying to figure out if it is possible to traverse across drives or shares. If I have a path that is concatenated in a web application, where the prefix is a drive, such as this: var path = "D:\"...
user avatar
  • 173