Questions tagged [path-injection]
The path-injection tag has no usage guidance.
28
questions
0
votes
1
answer
242
views
bash: how to securely source a script from an environment variable
Say I want to do source $VIRTUAL_ENV/bin/activate in my bashrc whenever the VIRTUAL_ENV is defined.
In general, the idea of running a script pointed by an environment variable seems a bit fishy as it ...
- 103
1
vote
0
answers
118
views
Any Windows/NTFS trick to ignore/cancel out a file extension from a path?
I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call:
File.Open("C:\Resources\"+resName+".res&...
1
vote
1
answer
343
views
Some random string is appended prefixed by a DOT at the end of URL
Recently we have run some Security scan report on one of our web-application and it has one issue reported as a path-based vulnerability. The scenario is as follows.
The request URL which our ...
- 111
2
votes
1
answer
671
views
Using this path traversal security issue
I used zap to scan one of my websites and found a path traversal issue.
These are the informations:
Attack: c:/
URL: www.example.com/example.php
Parameter: mail
I am now tinkering around in the ...
- 157
3
votes
1
answer
550
views
Sanitising a file/folder path from user input
I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush.
The scp command below executed on the backup ...
- 441
2
votes
1
answer
109
views
What are the dangers of extending my PATH?
Are there any dangers of extending my PATH, say by adding /Users/me/bin?
- 1,680
0
votes
2
answers
822
views
Check for vulnerabilities on website having an error with realpath PHP
I found a website with a download.php file which can get different values in the url parameter (e.g. www.example.com/download.php?url=value). When I give ../../ as a value for the url it throws me the ...
- 103
4
votes
1
answer
3k
views
strstr and fopen, is there a bypass?
I have a binary that does this:
if (strstr(USERCONTROLLERSTRING, "..")) exit;
fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r");
then spits out all the content of the file. Is there any ...
- 193
94
votes
8
answers
17k
views
Can secret GET requests be brute forced? [duplicate]
Say, I have on my server a page or folder which I want to be secret.
example.com/fdsafdsafdsfdsfdsafdrewrew.html
or
example.com/fdsafdsafdsfdsfdsafdrewrewaa34532543432/admin/index.html
If the ...
- 921
7
votes
2
answers
2k
views
Do sudo and .profile/.bashrc enable trivial privilege escalation?
First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
- 215
1
vote
1
answer
184
views
Unable to replace linux binary
I'm working on a linux privilege escalation. This is the situation: I'm able to write to /bin, and I only have sudo access to run a script. This script just prints information with an echo.
I copied ...
- 171
1
vote
3
answers
9k
views
Path traversal via filename
Is it possible to perform path traversal by setting the filename of an uploaded path to include a path? Does Windows/Linux/any other operating system allow such filenames?
For example, naming a file "...
- 421
1
vote
3
answers
1k
views
Is it dangerous to pass user input to the require function in Node.js?
TL;DR: Is it dangerous to have user input used in a require function in Node.js? Can it be used to read files, and if so how can I protect against that?
For example, I have an ExpressJS server ...
- 111
9
votes
2
answers
2k
views
Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?
A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
- 1,289
0
votes
1
answer
178
views
Unsafe to not provide full path to powershell script?
Is the following statement in a batch file unsafe?
powershell -executionpolicy bypass -File .\test.ps1
test.ps1 is located in the same folder as the batch file.
Is it possible to add something in ...
- 127
-3
votes
2
answers
336
views
Are path traversal attacks possible if attacker is not authenticated? [closed]
Are path traversal attacks possible if attacker is not authenticated in web-application?
- 401
14
votes
2
answers
36k
views
Path traversal filter bypass techniques?
I have a Linux-based embedded system with web-interface for management purposes. According to one security paper, this web-server has rudimentary filter against directory traversal attacks in URL ...
- 401
1
vote
2
answers
3k
views
Is string concatenation vulnerable to null character in aspx?
I just see this line of code in VB in one file .aspx
FileUpload.SaveAs(sPath & "/" & FileUpload.FileName)
This line save a file that an user uploaded. It use the SaveAs method. I was worried ...
- 327
-2
votes
1
answer
10k
views
Alternative ways to exploit this path traversal
I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files:
A....
user15194
1
vote
3
answers
7k
views
How to exploit this include_once vulnerability in PHP?
I'm performing a static analysis on a PHP code and came across this situation:
include_once SYSTEM_PATH . 'languages/content-' . $_COOKIE ['lang'] . '.php';
If I try to hack with this HTTP request:
...
- 113
0
votes
0
answers
159
views
Should I be concerned about the following URLs that were tried to open on my webpage?
I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix
http://domain.com/some/url/$tags.get(%22pixelLink%22)...
- 413
5
votes
2
answers
3k
views
Any vulnerabilities in allowing users to choose path of S3 file?
I'm building a web app that uses S3. In some of our operations, we're creating a file on S3 with a path that's directly dependent on user input, so an attacker might cause a file to be created on S3 ...
- 2,028
-2
votes
1
answer
379
views
Commonly used url parameters [duplicate]
I'm working on a project that requires me to tamper with/rewrite url parameters. I'd also like to add in something that finds request parameters such as
?admin=false
?debugging=false
?page=example
...
- 243
3
votes
1
answer
1k
views
How to protect the code of Windows applications against path traversal?
I'm writing a simple HTTP server in Lua and while I can easily find resources on how to secure against Unix directory traversal, I already found some caveats in the Windows version. While I'm already ...
- 6,534
2
votes
3
answers
3k
views
sql injection, exec and preg_replace filter
Ive been informed this is not safe to use in regards to sql injection:
preg_replace("/[\"'%()@$.!&?_: #\/-]/","", mysql_real_escape_string($_GET['var']));
what would be the difference in the ...
- 123
3
votes
1
answer
2k
views
What attacks use enabled Apache's PATH_INFO?
In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There ...
- 5,357
1
vote
1
answer
230
views
Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?
I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
- 14k
7
votes
2
answers
4k
views
How do you exploit Directory Traversal to traverse from one drive/share to another?
I'm trying to figure out if it is possible to traverse across drives or shares. If I have a path that is concatenated in a web application, where the prefix is a drive, such as this:
var path = "D:\"...
- 173