Directory Traversal

Directory Traversal: This technique prints the content of a specified file. For example, if you load a file named "file.log," it will display the content of this log file. Essentially, this allows access to files beyond the web directory.

Way to identify:

# Example: 
http://mountaindesserts.com/meteor/index.php?page=../../../../../../../../../etc/passwd

There will be a parameter loading file. We can try payload to identify this vulnerability.

We can use burp suite intruder to test all parameter at once.

Exploiting it.

  • /etc/passwd: contains user account details (Linux)

  • /etc/shadow: contains password hashes (Linux, if accessible)

  • C:\windows\system32\config\SAM: contains user password hashes (Windows)

  • C:\inetpub\wwwroot\web.config: potentially sensitive configuration data for web servers running on Windows

  • Windows host file location: C:\Windows\System32\drivers\etc\hosts

Reading Application files : /var/www/html/config.php

Reading and writing log file: /var/log/apache2/access.log

We can do log poisoning.

circle-info

If there is an issue in SSH file then Check the format of the ssh file (Copy from kali terminal).

Give sufficient permission. (chmod 600 file_name)

Last updated