‫We're going to use a Wasp Broken Web applications and co. for this demo, first go to a Wasp Broken
‫Web applications page using its IP address or the domain name if you do find it in the host file.
‫I use a Wasp Wacom domain name, which is mapped with the IP address of the host machine on the main
‫page, I click Be Warp Link.
‫Which brings you to an extremely buggy web app.
‫Log in to the app.
‫The username is B as in the insect and the default password is bug.
‫Now there's a list inside the opened page Find Directory Traversal file item inside the list, select
‫it and press the hack button at the bottom of the list.
‫There's a message inside the open page that says try to climb higher Spidey.
‫OK, let's try.
‫Then when we look at the URL, we see the part page equals message dot text.
‫Always be suspicious of these kind of input fields.
‫Does the message not text file point directly to a file inside the server?
‫What if I change the file name or path to understand what happens when I try to reach another file inside
‫the web server?
‫Let's make a little preparation before I go to OWASP Dash BW Virtual Machine, go to route using CD
‫or CD slash Linux commands.
‫I want to create a text file here.
‫Echo Linux Command writes the text given as the parameter.
‫Here are text is we have an alternative exclamation point.
‫The greater then character redirects the output to the target, and I give the target as my message.
‫Text.
‫Check the file with the Cat Command.
‫We see that it contains our message.
‫Now, let's go back to the VWAP app and try to access this my message.
‫Text file, I put the file to route, so I have to navigate to route first in Linux systems.
‫Dot Dot slash characters are used to bring you to the outer folder.
‫If you put enough numbers of Dot Dot slash characters, you can reach the root folder.
‫What happens if you put tagged characters when you're at the root?
‫Well, absolutely nothing.
‫So you can put Dot Dot slashes in as many times as possible, then write the file name you want to access
‫my message, dot, text and hit enter.
‫As you can see, the text on the page has changed.
‫We have an alternative that means we accessed an arbitrary file inside the web server.
‫Now we can try to access the critical systems file since Dot Dot Slash worked fine.
‫Well, assume that the operating system of the web server has a Unix or Linux or BSD based operating
‫system because Microsoft operating systems use the backward slash instead of the forward slash.
‫Let's try to access the password file under the Cedar.
‫Voila!
‫We could read the password file flash Etsy slash password is a text file that contains the attributes
‫of each user or account on a computer running Linux or another Unix like operating system.
‫What else can we reached the shadow file?
‫The slash Etsy slash shadow file store's actual passwords in encrypted format for users accounts with
‫additional properties related to user passwords.
‫No, we cannot access the shadow file with the privileges of the card user.