What is path traversal?

Path traversal or directory traversal is a vulnerability where an attacker can request arbitrary files from a server by breaking out of a directory. Path traversal falls under the category “3: Injection” of the OWASP top 10

How does path traversal work?

Path traversal occurs when a user can request a file on the server and the server does not check the user’s input. For example, take the example below:

https://example.com/get_file.php?file=public/marketing.pdf

We see that the PHP file retrieves a PDF from the public folder. But what if we fill in another folder?

https://example.com/get_file.php?file=private/secret.txt

Without proper access control, the file “secret.txt” will now be downloaded. An attacker must know here that the file “secret.txt” exists and that it is present in the folder “private”. More on this later. Since we have now switched directories, we call this attack “directory traversal”.

In the example above, the directory is in the url. It is also possible to go up with a trick. The command to go up one folder is “../”. When the program cannot go any higher, the command will be ignored. On Linux, the /etc/passwd file is always present and readable. It used to contain passwords, but nowadays it’s more of a list of users. If we want to request this file, we can do the following:

https://example.com/get_file.php?file=../../../../../../../../etc/passwd

Although we have no idea how far up to go, we add ../ quite a few times. Maybe it’s too much, but that doesn’t matter. We should now be able to see the contents of /etc/passwd.

How does a hacker find files?

Some files are always in the same location, such as the passwd file. Others are often in the same location. For example, if we want to get the contents of get_file.php, chances are it’s in the /var/www/ or /var/www/html directory. However, this is not necessary, so it is a matter of guessing and trying commonly used paths. In the above example, the folder was named “private”. A hacker could find this out by looking at all the source code and finding references to the folder. An attacker can also try to request the access log. This logs which files have been requested, also by other users.

Default locations:
C:\windows\win.ini
C:\windows\system.ini
C:\windows\iis.log
C:\windows\System32\Drivers\etc\hosts
C:\inetpub\index.asp
/etc/passwd
/etc/shadow
/etc/crontab
var/www/logs/access_log
var/www/logs/access.log
/etc/httpd/logs/access.log
var/log/apache/access_log
var/log/apache2/access_log
/var/www/index.php
/var/www/html/index.php

path traversal

More information about our solutions

Do you want to make sure that your websites, apps or systems are free from vulnerabilities? Our experts are happy to work for you. For more information about our pentests or other services, please feel free to contact us via the contact form below. We are happy to tell you what we can do for you.

    Contact

    Randstad 22 147
    1316BM Almere

    info@cyberant.nl
    +31 (0)85 047 1590