Questions tagged [path-injection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
50 views

Are public paths/folder structures mean security risks for a website? [duplicate]

I'm just wondering.. Are public,visible paths/folder structures mean security risk for a website? For example, as you can see our folder structure and file names are clearly visible in our ajax calls. ...
0
votes
2answers
180 views

Check for vulnerabilities on website having an error with realpath PHP

I found a website with a download.php file which can get different values in the url parameter (e.g. www.example.com/download.php?url=value). When I give ../../ as a value for the url it throws me the ...
3
votes
1answer
501 views

strstr and fopen, is there a bypass?

I have a binary that does this: if (strstr(USERCONTROLLERSTRING, "..")) exit; fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r"); then spits out all the content of the file. Is there any ...
92
votes
8answers
16k views

Can secret GET requests be brute forced? [duplicate]

Say, I have on my server a page or folder which I want to be secret. example.com/fdsafdsafdsfdsfdsafdrewrew.html or example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html If the ...
6
votes
2answers
555 views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
1answer
93 views

Unable to replace linux binary

I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo. I copied ...
1
vote
1answer
1k views

Path traversal via filename

Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames? For example, naming a file "...
1
vote
3answers
566 views

Is it dangerous to pass user input to the require function in Node.js?

TL;DR: Is it dangerous to have user input used in a require function in Node.js? Can it be used to read files, and if so how can I protect against that? For example, I have an ExpressJS server ...
9
votes
2answers
476 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
0
votes
1answer
122 views

Unsafe to not provide full path to powershell script?

Is the following statement in a batch file unsafe? powershell -executionpolicy bypass -File .\test.ps1 test.ps1 is located in the same folder as the batch file. Is it possible to add something in ...
-3
votes
2answers
95 views

Are path traversal attacks possible if attacker is not authenticated? [closed]

Are path traversal attacks possible if attacker is not authenticated in web-application?
11
votes
2answers
10k views

Path traversal filter bypass techniques?

I have a Linux-based embedded system with web-interface for management purposes. According to one security paper, this web-server has rudimentary filter against directory traversal attacks in URL ...
1
vote
2answers
2k views

Is string concatenation vulnerable to null character in aspx?

I just see this line of code in VB in one file .aspx FileUpload.SaveAs(sPath & "/" & FileUpload.FileName) This line save a file that an user uploaded. It use the SaveAs method. I was worried ...
-2
votes
1answer
5k views

Alternative ways to exploit this path traversal

I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files: A....
1
vote
3answers
3k views

How to exploit this include_once vulnerability in PHP?

I'm performing a static analysis on a PHP code and came across this situation: include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php'; If I try to hack with this HTTP request: ...
0
votes
0answers
107 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix http://domain.com/some/url/$tags.get(%...
1
vote
2answers
555 views

Any vulnerabilities in allowing users to choose path of S3 file?

I'm building a web app that uses S3. In some of our operations, we're creating a file on S3 with a path that's directly dependent on user input, so an attacker might cause a file to be created on S3 ...
-2
votes
1answer
229 views

Commonly used url parameters [duplicate]

I'm working on a project that requires me to tamper with/rewrite url parameters. I'd also like to add in something that finds request parameters such as ?admin=false ?debugging=false ?page=example ...
3
votes
1answer
667 views

How to protect the code of Windows applications against path traversal?

I'm writing a simple HTTP server in Lua and while I can easily find resources on how to secure against Unix directory traversal, I already found some caveats in the Windows version. While I'm already ...
2
votes
3answers
2k views

sql injection, exec and preg_replace filter

Ive been informed this is not safe to use in regards to sql injection: preg_replace("/[\"'%()@$.!&?_: #\/-]/","", mysql_real_escape_string($_GET['var'])); what would be the difference in the ...
3
votes
1answer
1k views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
1
vote
1answer
165 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
7
votes
2answers
2k views

How do you exploit Directory Traversal to traverse from one drive/share to another?

I'm trying to figure out if it is possible to traverse across drives or shares. If I have a path that is concatenated in a web application, where the prefix is a drive, such as this: var path = "D:\"...