Posted by Directory traversal, also known as path traversal, is a type of vulnerability that allows an attacker to access files and directories stored outside the root directory of a web application. This can lead to the exposure of sensitive information, such as confidential files and database records, to unauthorized users.
The vulnerability occurs when the web application fails to properly validate user input, allowing an attacker to manipulate the file path to access sensitive information stored on the server. For example, an attacker could enter a URL such as “www.example.com/../../etc/passwd” to access the server’s password file.
Directory traversal attacks can be executed using several techniques, including manipulating the URL, using the “dot-dot-slash” (../) notation, and exploiting the use of absolute file paths. In some cases, the attacker may also be able to execute malicious code on the target server, leading to a full compromise of the system.
To protect against directory traversal attacks, web developers should follow best practices for validating user input. This includes checking the input for any “dot-dot-slash” sequences, filtering out any unexpected characters, and limiting the maximum length of the input. In addition, it is important to keep all software and systems up to date with the latest security patches and updates.
Tools
Basic exploitation
We can use the .. characters to access the parent directory, the following strings are several encoding that can help you bypass a poorly implemented filter.
16 bits Unicode encoding
UTF-8 Unicode encoding
Bypass “../” replaced by “”
Sometimes you encounter a WAF which remove the “../” characters from the strings, just duplicate them.
Bypass “../” with “;”
Double URL encoding
e.g: Spring MVC Directory Traversal Vulnerability (CVE-2018-1271) with http://localhost:8080/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.ini
UNC Bypass
An attacker can inject a Windows UNC share (‘\UNC\share\name’) into a software system to potentially redirect access to an unintended location or arbitrary file.
NGINX/ALB Bypass
NGINX in certain configurations and ALB can block traversal attacks in the route, For example: http://nginx-server/../../ will return a 400 bad request.
To bypass this behaviour just add forward slashes in front of the url: http://nginx-server////////../../
Java Bypass
Bypass Java’s URL protocol
Path Traversal
Interesting Linux files
/etc/issue
/etc/passwd
/etc/shadow
/etc/group
/etc/hosts
/etc/motd
/etc/mysql/my.cnf
/proc/[0-9]*/fd/[0-9]* (first number is the PID, second is the filedescriptor)
/proc/self/environ
/proc/version
/proc/cmdline
/proc/sched_debug
/proc/mounts
/proc/net/arp
/proc/net/route
/proc/net/tcp
/proc/net/udp
/proc/self/cwd/index.php
/proc/self/cwd/main.py
/home/$USER/.bash_history
/home/$USER/.ssh/id_rsa
/run/secrets/kubernetes.io/serviceaccount/token
/run/secrets/kubernetes.io/serviceaccount/namespace
/run/secrets/kubernetes.io/serviceaccount/certificate
/var/run/secrets/kubernetes.io/serviceaccount
/var/lib/mlocate/mlocate.db
/var/lib/mlocate.db
Interesting Windows files
Always existing file in recent Windows machine. Ideal to test path traversal but nothing much interesting inside…
Interesting files to check out (Extracted from https://github.com/soffensive/windowsblindread)
c:/boot.ini
c:/inetpub/logs/logfiles
c:/inetpub/wwwroot/global.asa
c:/inetpub/wwwroot/index.asp
c:/inetpub/wwwroot/web.config
c:/sysprep.inf
c:/sysprep.xml
c:/sysprep/sysprep.inf
c:/sysprep/sysprep.xml
c:/system32/inetsrv/metabase.xml
c:/sysprep.inf
c:/sysprep.xml
c:/sysprep/sysprep.inf
c:/sysprep/sysprep.xml
c:/system volume information/wpsettings.dat
c:/system32/inetsrv/metabase.xml
c:/unattend.txt
c:/unattend.xml
c:/unattended.txt
c:/unattended.xml
c:/windows/repair/sam
c:/windows/repair/system
The following log files are controllable and can be included with an evil payload to achieve a command execution
/var/log/apache/access.log
/var/log/apache/error.log
/var/log/httpd/error_log
/usr/local/apache/log/error_log
/usr/local/apache2/log/error_log
/var/log/nginx/access.log
/var/log/nginx/error.log
/var/log/vsftpd.log
/var/log/sshd.log
/var/log/mail
In conclusion, directory traversal attacks are a serious threat to the security of web applications and must be taken into consideration when developing and deploying web-based systems. By following best practices for validating user input and keeping systems up to date, organizations can reduce the risk of a successful attack and protect sensitive information from exposure.
Spyboy blog 