[Autogenerated] from my current location on this system.
If I want to view any file, I can either use the absolute or relative path.
I will use the dot dot slash syntax to output the contents of the etc.
Password file.
Okay,
so what this demonstrates is that I can use the path relative to my
current file system location to traverse the directory structure until
I get to the path of the etc password file.
By the way there is nothing nefarious about what just happened.
Let me show you something.
If I add some more dots and slashes, I still get the same results.
This is because once I get to the top of the directory hierarchy,
the additional dots and slashes don't have any meaningful effect.
However, for an attacker,
this means that even if they have more dots and slashes
than required to reach the root directory,
their attack will likely still succeed.
Let's jump over to a web browser here we are.
Most major web servers do a great job of preventing directory traversal attacks.
However, even though these web servers are hardened against this sort of attack,
web applications that accept input from users may provide an
attacker with a method to bypass the web servers,
security controls,
I have mod security configured in a detection only mode
so we can see a successful attack.
Keep an eye on the URL parameter.
I'm going to click file two dot PHP notice that the
parameter and page contents both changed.
The first thing that comes to mind is,
can I specify a known system file and have the web app
output the contents to the page.
Let's try out the dot dot slash syntax I showed you earlier to
see if we can retrieve the etc password file.
Oh I can confidently say that this is not capital letters
underscore what you want to see as a defender.
Let's see if my security logged the event.
Great.
So at least we have a record of what happened.
We can see the rule file, name, severity level,
paranoia level and many other data points.
If you're wondering why the rule file says LF I
which stands for local file include.
That's because technically we used a directory traversal attack to
_____ a URL parameter which then displayed a local file which is
the etc password as I move further up we can see the full get
request that the attacker used.
Alright, so now I'm going to repeat the same directory.
Traversal attack.
But first let me turn on my security protection and then restart the web server.
The U R.
L I used from the previous attack is still there.
So I'm just going to highlight and press enter.
Wonderful.
That's what we want to see.
Of course it's even better not to have that vulnerability in the
first place but at least you can see the value of my security as
an additional layer of defense.
Now going back to the logs this time we can see much of what
we saw with mod security protection off.
But now we also have the 403 HTTP response code.