Burkham to read you a lecture in this lecture we will talk about that it repat Travis right.
One example that how it look.
For this example I'm using Lego dot net taken from orderless piece broken of of application project.
Let's open up the goat then sure that burp is correctly configured with the browser in the above shield.
My intercept is off now.
Here you will see that Lego trail application.
So our task is to try to find five drivers or one letter the.
The beginning of the lecture.
I already told that there will never be prizes because an attacker can place but a set of sequences
in the file name to backtrack from current directory the classic but traversals sequence is known as
Dardar Lachish so visit the web page of the application.
That you are testing.
Now click on files available for downloads.
Back to the Web site and click on intercept is on in the proxy intercept.
Now at the world that includes the parameter us to test.
So what I'm going to do is click on any of the download files link.
Here is my proxy is linking the request will be captured in the proxy intercept tab here you will see
that this request is get Mathunjwa quest you are in filename as a parameter.
Right click anywhere on the quest to bring up the context menu.
Click on send to Peter.
Here we can input various payloads.
Into the input field of evaluation and monitor the response side by side.
Now click on the go button in the Peter to send the request to the server.
You can observe that the response from the server in the repeater response panel continued to monitor
the response as you Delight's bad drivers as detection techniques you'll see or hear Content-Length
is says there were five there were seven.
Now we can check whether our input is used in the failed spot or if not to perform this test.
We can compare the response from the server then injecting dots flash and Darger slash into the file
name parameter.
Let's inject that last payload.
Click on go button here you can see that the response appears unchanged.
After inserting the dot slash payload content.
Land sakes never fired over Savain.
Now private Dardar slash
bellowed click on go here you will see or hear that Content-Length is changed.
Working on the assumption that the parameter you are targeting is being appended to the present directory
specified by the application.
You can modify the parameters values to insert an arbitrary subdirectory and Singletary cigarettes.
If the application response is identical to the initial response it may be vulnerable.
If you find any instances where the application may be well Neven the next test is to attempt to traverse
out of the starting directory and access files from elsewhere on the server file system.
You can access files is dependent on the server and what framework you are testing like is we don't
need BHP DSP and so our location is using an XP Dot Net Framework Lebert conflict is the main settings
and configuration file for an if production application.
Suppose if we are attacking a damn good application server we might look for a that exemplify
that dot dot slash red dot on feek hit Go button.
Here you will see that Laborde config at similar fine using this will ever be.
You may be able to travel out of the starting Darity and Nexxus a known word reachable fine on the operating
system in question Dardar last doctor's last saw flash.
It is the password for Linux OS Danders lash Danders last.
So our dart board Flash Windows slash Lindhardt in the far Windows is
let's try it here.
Here you can see that we have successfully accessed password 5.
Let's look at brief preventing direct returns the next first fall and sure you have installed the latest
version of web server software.
I am sure that all patches had been applied ideally remore everything but the good data and filter matter
kept us from the user input.
This will ensure that only what should be entered in the field will be submitted to the server.
And this really a richer if you have any doubt on any instances.
Feel free to ask.
Thanks for watching.
See you in next lecture.