Pat traversal.
Web applications sometimes require reading from or writing to a file system.
So by crafting parameters that reference files on the system, yeah, it's possible to access other
files that are stored on the server.
So a path traversal attack may enable us to read sensitive data, including passwords, application
logs and oh so much more.
And we can view security critical items such as configuration files and software binaries as well.
Now, if we're really good, we're able to navigate out of the Webroot folder and then we can perform
paff traversal attacks.
So users should only be restricted to the Web directory.
OK, and they should not be able to access anything above the webroot.
Now, the most basic path traversal attack is using the dot, dot, slash to move up one directory.
And most Web servers have been locked down to prevent this attack.
But you never know.
Some will still accept it.
OK, and so let's go to Calli, log in to be Web.
Use the drop down menu and open directory traversal directory.
Now, there's nothing strange on the first page at first look.
But look at this, see, when you start to pay attention to the Eurail, the directory parameter in
the early can reveal something.
So let's delete this value.
So the warning this directory doesn't exist appears.
OK.
This means that parameter takes the name of the folder on the file system and prints the content of
that folder.
So now we can guess folder's generally residing in applications such as JavaScript.
Images.
Stylesheets.
And, of course, admen.
Oh, it works perfectly.
OK, so then we can try to traverse in the directories now.
So for this, we need to climb up in between folder's.
Now, I know that the back end is Lennix, and so that means I'm going to use Linux filesystems placeholders
to traverse between folders.
So first thing to do is print what's inside the current folder.
And the application executes the placeholder for the current directory.
And look at the documents and folders under the current directory.
Right, so we are still in the current directory now, climb up one level using this placeholder.
And it works.
Climb up one more level again and climb up one more again.
I think we should be in the directory now.
But we can try to climb up one more again.
All right, so climbing up is done, so now it's time to traverse.
Visa home directory.
And these are the user's home directories.
So we'll go to B's folder.
OK, to go to document.
And view the scripts folder.
And here are some scripts that run over the system.
So in a situation like this, you can view many important files and configurations, right?
In past reversal, I generally go to the ETEK directory and show password file.
But this vulnerability these days works really only to view the content of the folders and not the files
themselves.
OK, so anyway, let's change the level now to medium.
OK, and put the current folder placeholder to check traversing and of course, we get a warning.
We are detected.
So let's see if that means that we also cannot climb.
OK, so sadly, that's true.
Climbing is fun.
But what happens if you just drive forward slash oh, that works, OK, so it prints the content of
the root directory.
I think the developer is escaping the dot.
So we can check the code later.
Right now, let's go to B's folder.
And that's nice this way we can traverse between folder's and now let's change the level of high, so
delete the current value.
An error message appears and hasn't stopped us before, so let's try to climb.
And traverse.
OK, so that's not working.
So now let's go and view the code.
So if you directory traversal to page and scroll down to code.
So here's a function called Show Directory.
And it has a directory parameter.
Check and see if the directory exists to the content of that directory.
Scroll down a little bit more.
And the directory parameter and you are l passes to the show directory function.
So the security level's low, show directory function just executes if the level is medium, the parameter
we provide from the URL is checked with directory traversal check to function.
And for the high level directory traversal, check three is used.
All right, so now let's have a look at these two functions that scroll down to the functions that were
searching.
All right, so here's the last one.
That's why we are restricted to Webroot directory only.
All right, so now let's go to the other function, and it checks for placeholders that we use to climb
and reverse.
All right, so you get the idea, you can always analyze a code more line by line by yourself.